6b3891dea6d6d099fc6af462790176d0a1ac24b70b6fde00ceb8c37fe912b141

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 13:02

Target

6b3891dea6d6d099fc6af462790176d0a1ac24b70b6fde00ceb8c37fe912b141.exe
Size

117KB
MD5

9852b7863ac81976775e1c6390b247c5
SHA1

3643daa06b8176d188813a78625aa8da12e23774
SHA256

6b3891dea6d6d099fc6af462790176d0a1ac24b70b6fde00ceb8c37fe912b141
SHA512

1e0937486786b3e0e2374486823801e2f5af661dee18276c45f46c0cb73d670fa433c756001a660da89ac2eb204dc4d10a68614b5745d31eb4b031fa9ddfc3d0
SSDEEP

3072:UtESdZPF5k/MLMkHPykXyy2pruuDwcZCAh90Afi6Ujv:UthPFO4vy8adyqctb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1528	1352	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1528	1352	6b3891dea6d6d099fc6af462790176d0a1ac24b70b6fde00ceb8c37fe912b141.exe	26
PID 1352 wrote to memory of 1528	1352	6b3891dea6d6d099fc6af462790176d0a1ac24b70b6fde00ceb8c37fe912b141.exe	26
PID 1352 wrote to memory of 1528	1352	6b3891dea6d6d099fc6af462790176d0a1ac24b70b6fde00ceb8c37fe912b141.exe	26
PID 1352 wrote to memory of 1528	1352	6b3891dea6d6d099fc6af462790176d0a1ac24b70b6fde00ceb8c37fe912b141.exe	26

C:\Users\Admin\AppData\Local\Temp\6b3891dea6d6d099fc6af462790176d0a1ac24b70b6fde00ceb8c37fe912b141.exe
"C:\Users\Admin\AppData\Local\Temp\6b3891dea6d6d099fc6af462790176d0a1ac24b70b6fde00ceb8c37fe912b141.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 44
  2⤵
  - Program crash
  PID:1528