6b1b3c1a27b446466a4c42f612ac1f10213d6e49d5551ee913279761af2788f7

Analysis

max time kernel
233s
max time network
332s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 08:12

Target

6b1b3c1a27b446466a4c42f612ac1f10213d6e49d5551ee913279761af2788f7.exe
Size

47KB
MD5

0fd9557008be54d2c6ecb6e7e5ecf820
SHA1

659c398937419b51f5828a9ed75410e1ec53dade
SHA256

6b1b3c1a27b446466a4c42f612ac1f10213d6e49d5551ee913279761af2788f7
SHA512

841af62c907739a48b5206f3cfc260857fb17ade06e4ef1e5d56f16771686f875fb634f23f5a9b4faffd3bd458b7d050217dcd51d2d47f976c32c855592d8713
SSDEEP

384:M6mIKeHBocMofgVf3ynjKXnpOIkswxo4Mcef2tLr8gdk:DJH8cjKogQM1or52

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
852	876	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 852	876	6b1b3c1a27b446466a4c42f612ac1f10213d6e49d5551ee913279761af2788f7.exe	28
PID 876 wrote to memory of 852	876	6b1b3c1a27b446466a4c42f612ac1f10213d6e49d5551ee913279761af2788f7.exe	28
PID 876 wrote to memory of 852	876	6b1b3c1a27b446466a4c42f612ac1f10213d6e49d5551ee913279761af2788f7.exe	28
PID 876 wrote to memory of 852	876	6b1b3c1a27b446466a4c42f612ac1f10213d6e49d5551ee913279761af2788f7.exe	28

C:\Users\Admin\AppData\Local\Temp\6b1b3c1a27b446466a4c42f612ac1f10213d6e49d5551ee913279761af2788f7.exe
"C:\Users\Admin\AppData\Local\Temp\6b1b3c1a27b446466a4c42f612ac1f10213d6e49d5551ee913279761af2788f7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 36
  2⤵
  - Program crash
  PID:852