6fdd6f2c3085c356820653d11b87d831772b3f1733fa49adb6b4b9f8cf2a6ec3

Analysis

max time kernel
140s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15-03-2023 05:26

Target

6fdd6f2c3085c356820653d11b87d831772b3f1733fa49adb6b4b9f8cf2a6ec3.exe
Size

1.5MB
MD5

7464af07a0ae8d444a40f5f734ffa23c
SHA1

c183a90a191feccd25f8ac5cfba452bf0f1a718d
SHA256

6fdd6f2c3085c356820653d11b87d831772b3f1733fa49adb6b4b9f8cf2a6ec3
SHA512

7634a5d32e400a13a38bb6009b275647b59dce309b46089f5dbff506a22f4e9997e7e5ee886eba9d5d8c5a8b8be612134f7d31792e03ffddef10b8e46a44934a
SSDEEP

24576:ozPaiHva3yZNG95MRLkiT1B9NtE3aUC4NXuJX+KQayWWN24xddkpJwewbtZUPAf9:yPMiHZkiT1B9Q/Fr2Em8eHPAf4GGts

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

592 1212 WerFault.exe 6fdd6f2c3085c356820653d11b87d831772b3f1733fa49adb6b4b9f8cf2a6ec3.exe

pid	pid_target	process	target process
592	1212	WerFault.exe	6fdd6f2c3085c356820653d11b87d831772b3f1733fa49adb6b4b9f8cf2a6ec3.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6fdd6f2c3085c356820653d11b87d831772b3f1733fa49adb6b4b9f8cf2a6ec3.exe

description	pid	process	target process
PID 1212 wrote to memory of 592	1212	6fdd6f2c3085c356820653d11b87d831772b3f1733fa49adb6b4b9f8cf2a6ec3.exe	WerFault.exe
PID 1212 wrote to memory of 592	1212	6fdd6f2c3085c356820653d11b87d831772b3f1733fa49adb6b4b9f8cf2a6ec3.exe	WerFault.exe
PID 1212 wrote to memory of 592	1212	6fdd6f2c3085c356820653d11b87d831772b3f1733fa49adb6b4b9f8cf2a6ec3.exe	WerFault.exe
PID 1212 wrote to memory of 592	1212	6fdd6f2c3085c356820653d11b87d831772b3f1733fa49adb6b4b9f8cf2a6ec3.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\6fdd6f2c3085c356820653d11b87d831772b3f1733fa49adb6b4b9f8cf2a6ec3.exe
"C:\Users\Admin\AppData\Local\Temp\6fdd6f2c3085c356820653d11b87d831772b3f1733fa49adb6b4b9f8cf2a6ec3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 604
2⤵
- Program crash
PID:592

memory/1212-54-0x0000000000400000-0x00000000008DE000-memory.dmp

Filesize
4.9MB

Download
memory/1212-55-0x0000000000400000-0x00000000008DE000-memory.dmp

Filesize
4.9MB

Download
memory/1212-56-0x0000000000400000-0x00000000008DE000-memory.dmp

Filesize
4.9MB

Download
memory/1212-57-0x0000000000400000-0x00000000008DE000-memory.dmp

Filesize
4.9MB

Download
memory/1212-58-0x0000000000400000-0x00000000008DE000-memory.dmp

Filesize
4.9MB

Download
memory/1212-59-0x0000000000400000-0x00000000008DE000-memory.dmp

Filesize
4.9MB

Download
memory/1212-61-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1212-66-0x0000000000400000-0x00000000008DE000-memory.dmp

Filesize
4.9MB

Download
memory/1212-67-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1212-68-0x0000000000400000-0x00000000008DE000-memory.dmp

Filesize
4.9MB

Download