910880988e77b32d84628e9712bc7078ac2a6dc20a7b4efd18e991d297d834cc

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23-08-2023 05:59

Target

d6481d419412e5a0500b328f18cf45a8.exe
Size

69KB
MD5

d6481d419412e5a0500b328f18cf45a8
SHA1

a098e1a9b56670c2ec8027dfd8143556b3194f0f
SHA256

910880988e77b32d84628e9712bc7078ac2a6dc20a7b4efd18e991d297d834cc
SHA512

935014878f0b6cb1a46c1a18a1267fb88695e18493e8940fd4bf3bcad7f3543805b40bd48bada3815928edf8ce130c2fcbf5b629fd63ece370606b5b54b611d4
SSDEEP

1536:gxybOxHFkjT4kgUOmnbE+oMU3UBwsxYV2OfWrxLbWYxc20:gAbOxejTBOybEmwyxYV2O/p

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2428	2604	WerFault.exe	28

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2428	2604	d6481d419412e5a0500b328f18cf45a8.exe	29
PID 2604 wrote to memory of 2428	2604	d6481d419412e5a0500b328f18cf45a8.exe	29
PID 2604 wrote to memory of 2428	2604	d6481d419412e5a0500b328f18cf45a8.exe	29

C:\Users\Admin\AppData\Local\Temp\d6481d419412e5a0500b328f18cf45a8.exe
"C:\Users\Admin\AppData\Local\Temp\d6481d419412e5a0500b328f18cf45a8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2604 -s 72
  2⤵
  - Program crash
  PID:2428