c6a5dbef37277153256cd07e905d8ef7c6113e47ec911db345633009ef596a28

Analysis

max time kernel
38s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 07:31

Target

c6a5dbef37277153256cd07e905d8ef7c6113e47ec911db345633009ef596a28.exe
Size

77KB
MD5

9d36b06e89e6c95a519463e5a42c5ae1
SHA1

1f8eaebd85fbb7e6ee9106a0e7dbe5b71a8f6723
SHA256

c6a5dbef37277153256cd07e905d8ef7c6113e47ec911db345633009ef596a28
SHA512

f855a05324420e649454c9fa546db7f29a4953e21bff6f1748cadf72e4f0e2e5a2d6cad625fbd7e0da298cc67110f5bfb3e859c0e4b4e9ed37e8653b8dc400e3
SSDEEP

1536:LgPqdb3TSSLRhnzPob+V/pnZLJpXSG5h985e73zq2/laCagLXcNOzS3:CO3TSIbzPob6vLJBR79H3u9Cag4NOm3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1936	2000	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1936	2000	c6a5dbef37277153256cd07e905d8ef7c6113e47ec911db345633009ef596a28.exe	28
PID 2000 wrote to memory of 1936	2000	c6a5dbef37277153256cd07e905d8ef7c6113e47ec911db345633009ef596a28.exe	28
PID 2000 wrote to memory of 1936	2000	c6a5dbef37277153256cd07e905d8ef7c6113e47ec911db345633009ef596a28.exe	28
PID 2000 wrote to memory of 1936	2000	c6a5dbef37277153256cd07e905d8ef7c6113e47ec911db345633009ef596a28.exe	28

C:\Users\Admin\AppData\Local\Temp\c6a5dbef37277153256cd07e905d8ef7c6113e47ec911db345633009ef596a28.exe
"C:\Users\Admin\AppData\Local\Temp\c6a5dbef37277153256cd07e905d8ef7c6113e47ec911db345633009ef596a28.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 120
  2⤵
  - Program crash
  PID:1936