6a0b168fdb278c931cd2d443c03169fd788ce5841f35808e57f54dc16db1d719

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 12:33

Target

6a0b168fdb278c931cd2d443c03169fd788ce5841f35808e57f54dc16db1d719.exe
Size

63KB
MD5

d5d83965123e807a9ce98b6e6ba8cdd8
SHA1

31829ccccb770e849bbfd0a8bde804c138f44f3f
SHA256

6a0b168fdb278c931cd2d443c03169fd788ce5841f35808e57f54dc16db1d719
SHA512

23c0b288a02b04e8d4ff4f6795549332b9cc25a41ace5d30d218255e1fa29bf78547c94625f5cb23f88a1f1d955f87b6c3db4737eefabbc8f39cdbb4b635367d
SSDEEP

1536:2o///IPLfqFFzLglhhEnxjjvD4ZojMu0udMwJoBPv4Zuth4h5:SP7qQlhylKowuF7aPvJH4h5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
536	1944	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 536	1944	6a0b168fdb278c931cd2d443c03169fd788ce5841f35808e57f54dc16db1d719.exe	27
PID 1944 wrote to memory of 536	1944	6a0b168fdb278c931cd2d443c03169fd788ce5841f35808e57f54dc16db1d719.exe	27
PID 1944 wrote to memory of 536	1944	6a0b168fdb278c931cd2d443c03169fd788ce5841f35808e57f54dc16db1d719.exe	27
PID 1944 wrote to memory of 536	1944	6a0b168fdb278c931cd2d443c03169fd788ce5841f35808e57f54dc16db1d719.exe	27

C:\Users\Admin\AppData\Local\Temp\6a0b168fdb278c931cd2d443c03169fd788ce5841f35808e57f54dc16db1d719.exe
"C:\Users\Admin\AppData\Local\Temp\6a0b168fdb278c931cd2d443c03169fd788ce5841f35808e57f54dc16db1d719.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 36
  2⤵
  - Program crash
  PID:536

memory/1944-55-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download