ff06469c0eeec54e3545ed8aee2f476ffeaa4b7e835ee0e2ec8df0318ccc74da

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
21-08-2023 13:49

Target

ff06469c0eeec54e3545ed8aee2f476ffeaa4b7e835ee0e2ec8df0318ccc74da.exe
Size

314KB
MD5

fb2ce344d1dcee1ea15451d7cf8f77cf
SHA1

f88d026cf156bde1a658c5e2539b877d64bcfcc3
SHA256

ff06469c0eeec54e3545ed8aee2f476ffeaa4b7e835ee0e2ec8df0318ccc74da
SHA512

f961cccaac6fe4537f703a8643245be4a5a59906c594fd48627501f53f5c64f53624d12a756da550a03d75363647ba5c5b47b90af8ad792c44027a37608a60f1
SSDEEP

6144:o9czeT/MImn5ryUd/UNUs/DbVao4qqPIBXtHSWENLVxORfIo:CTzkryUdcnVWqqPIBONhxsfIo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2052	1788	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 2052	1788	ff06469c0eeec54e3545ed8aee2f476ffeaa4b7e835ee0e2ec8df0318ccc74da.exe	28
PID 1788 wrote to memory of 2052	1788	ff06469c0eeec54e3545ed8aee2f476ffeaa4b7e835ee0e2ec8df0318ccc74da.exe	28
PID 1788 wrote to memory of 2052	1788	ff06469c0eeec54e3545ed8aee2f476ffeaa4b7e835ee0e2ec8df0318ccc74da.exe	28
PID 1788 wrote to memory of 2052	1788	ff06469c0eeec54e3545ed8aee2f476ffeaa4b7e835ee0e2ec8df0318ccc74da.exe	28

C:\Users\Admin\AppData\Local\Temp\ff06469c0eeec54e3545ed8aee2f476ffeaa4b7e835ee0e2ec8df0318ccc74da.exe
"C:\Users\Admin\AppData\Local\Temp\ff06469c0eeec54e3545ed8aee2f476ffeaa4b7e835ee0e2ec8df0318ccc74da.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 124
  2⤵
  - Program crash
  PID:2052