b9d6ead9baa77c5933e78e648e97f9f73a94ffb0a306affb908c8f31e7a88ec6

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
22-08-2023 10:40

Target

tmp.exe
Size

590KB
MD5

6611d09b189022dc685a871698f02144
SHA1

b24458ea32b8afef685199a53de7b00c92993a53
SHA256

b9d6ead9baa77c5933e78e648e97f9f73a94ffb0a306affb908c8f31e7a88ec6
SHA512

4a1eaffa80482e52965fab4cc48015903fe7c1802aaf3e0dbe4ff18afb489dcd9118f7e31d40d8da09629a3245838deb979049210378cdd8379648eee2ab6ef1
SSDEEP

12288:ZrcOh+xGb/8joNrz4OlpzC9dvyfu5YyxdeQXt7ZjSg:zh18+4OlpzCryfuvZ5kg

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2376	1412	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

tmp.exe

description	pid	Process	procid_target
PID 1412 wrote to memory of 2376	1412	tmp.exe	30
PID 1412 wrote to memory of 2376	1412	tmp.exe	30
PID 1412 wrote to memory of 2376	1412	tmp.exe	30
PID 1412 wrote to memory of 2376	1412	tmp.exe	30

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 664
  2⤵
  - Program crash
  PID:2376

memory/1412-53-0x0000000001240000-0x00000000012DA000-memory.dmp

Filesize
616KB

Download
memory/1412-54-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download
memory/1412-55-0x0000000004C90000-0x0000000004CD0000-memory.dmp

Filesize
256KB

Download
memory/1412-56-0x0000000000570000-0x000000000058A000-memory.dmp

Filesize
104KB

Download
memory/1412-57-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download
memory/1412-58-0x0000000004C90000-0x0000000004CD0000-memory.dmp

Filesize
256KB

Download
memory/1412-59-0x00000000005A0000-0x00000000005AE000-memory.dmp

Filesize
56KB

Download