6e4dec29efc05f9571c7c1fa8544a5faa26f039a54e5a9b0ed6bd3c9d5bf7ba3

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23/08/2023, 05:20

Target

6e4dec29efc05f9571c7c1fa8544a5faa26f039a54e5a9b0ed6bd3c9d5bf7ba3.exe
Size

3.4MB
MD5

06ea87a6ac60b7829b4932b4b4e8b1ae
SHA1

0068480ddda823974523f91ebf2beaf68dbf9de2
SHA256

6e4dec29efc05f9571c7c1fa8544a5faa26f039a54e5a9b0ed6bd3c9d5bf7ba3
SHA512

71f284f04bea852c74655a50e7ef0922f4bec6fdf5ca0e7a9e69f6bd837b97636ea5690083947104312d7da1c49691fa3a278d18c6536ffb344a8229983c7a95
SSDEEP

49152:xsxDSZ7KBt3VSwUhpXntTclks6mQkGnzAzzvNtski4+QQoK+yINU:xsxKeBDJIXNcksJGzSzjQQQoK+yINU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1892	2664	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 1892	2664	6e4dec29efc05f9571c7c1fa8544a5faa26f039a54e5a9b0ed6bd3c9d5bf7ba3.exe	28
PID 2664 wrote to memory of 1892	2664	6e4dec29efc05f9571c7c1fa8544a5faa26f039a54e5a9b0ed6bd3c9d5bf7ba3.exe	28
PID 2664 wrote to memory of 1892	2664	6e4dec29efc05f9571c7c1fa8544a5faa26f039a54e5a9b0ed6bd3c9d5bf7ba3.exe	28
PID 2664 wrote to memory of 1892	2664	6e4dec29efc05f9571c7c1fa8544a5faa26f039a54e5a9b0ed6bd3c9d5bf7ba3.exe	28

C:\Users\Admin\AppData\Local\Temp\6e4dec29efc05f9571c7c1fa8544a5faa26f039a54e5a9b0ed6bd3c9d5bf7ba3.exe
"C:\Users\Admin\AppData\Local\Temp\6e4dec29efc05f9571c7c1fa8544a5faa26f039a54e5a9b0ed6bd3c9d5bf7ba3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 120
  2⤵
  - Program crash
  PID:1892

memory/2664-53-0x0000000000FF0000-0x0000000001123000-memory.dmp

Filesize
1.2MB

Download