6f590f69c92d9b2e67fa5a6be88ba7fd8ecc50c52927d785f94b81da89a4b3c4

Analysis

max time kernel
140s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
04-03-2023 04:47

Target

6f590f69c92d9b2e67fa5a6be88ba7fd8ecc50c52927d785f94b81da89a4b3c4.exe
Size

4.9MB
MD5

4555e78b4b581ddf97f79dad2a2426c5
SHA1

a4c74f78080eaa3578cfe8f2652bb07b86bd9362
SHA256

6f590f69c92d9b2e67fa5a6be88ba7fd8ecc50c52927d785f94b81da89a4b3c4
SHA512

61686890af78559ef0ea149fcaea4127b3873680fd0e1db4defededf2fc1f390cfd58ae0b8d3770e0733edaf1cf884adaec4d197acf2b2f2c3a631e7d45da76e
SSDEEP

98304:uxxSruAGbl51kDt/H9bieeN7AaZRdZDHLCh/MX/kBn/f4BlR/fZWNz:CSrk31Y1bdeNkaZR/nCh/MX/k2DR/hk

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2040 1060 WerFault.exe 6f590f69c92d9b2e67fa5a6be88ba7fd8ecc50c52927d785f94b81da89a4b3c4.exe

pid	pid_target	process	target process
2040	1060	WerFault.exe	6f590f69c92d9b2e67fa5a6be88ba7fd8ecc50c52927d785f94b81da89a4b3c4.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6f590f69c92d9b2e67fa5a6be88ba7fd8ecc50c52927d785f94b81da89a4b3c4.exe

description	pid	process	target process
PID 1060 wrote to memory of 2040	1060	6f590f69c92d9b2e67fa5a6be88ba7fd8ecc50c52927d785f94b81da89a4b3c4.exe	WerFault.exe
PID 1060 wrote to memory of 2040	1060	6f590f69c92d9b2e67fa5a6be88ba7fd8ecc50c52927d785f94b81da89a4b3c4.exe	WerFault.exe
PID 1060 wrote to memory of 2040	1060	6f590f69c92d9b2e67fa5a6be88ba7fd8ecc50c52927d785f94b81da89a4b3c4.exe	WerFault.exe
PID 1060 wrote to memory of 2040	1060	6f590f69c92d9b2e67fa5a6be88ba7fd8ecc50c52927d785f94b81da89a4b3c4.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\6f590f69c92d9b2e67fa5a6be88ba7fd8ecc50c52927d785f94b81da89a4b3c4.exe
"C:\Users\Admin\AppData\Local\Temp\6f590f69c92d9b2e67fa5a6be88ba7fd8ecc50c52927d785f94b81da89a4b3c4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 212
2⤵
- Program crash
PID:2040

memory/1060-54-0x0000000000400000-0x00000000010E3000-memory.dmp

Filesize
12.9MB

Download
memory/1060-57-0x0000000000400000-0x00000000010E3000-memory.dmp

Filesize
12.9MB

Download