a60bb9ee906a7ca067d9cd1e074f8f7ce7af6148801a806b64608019b0159b5e

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08/10/2023, 11:09

Target

a60bb9ee906a7ca067d9cd1e074f8f7ce7af6148801a806b64608019b0159b5e.exe
Size

13.6MB
MD5

9713e6da13514088fa2a885ff37e76bc
SHA1

d796d3527c099a5636e88fd760115525d862ef8c
SHA256

a60bb9ee906a7ca067d9cd1e074f8f7ce7af6148801a806b64608019b0159b5e
SHA512

05178052ff396f69941e941b66d6d6edec39129d45c4cededb953322cfe63148d780d0056a0001be04e1115b620e11c26e33e87f23dec5990ad7742b38e6aa91
SSDEEP

196608:WYZ9X+PVZPs6AKPy6MKpdqC7MRPOZmVc1Dat8AiL+uUesfXk5Pp:WkEdfAiyGn57M7Vcx9a5f0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1988	1956	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 1988	1956	a60bb9ee906a7ca067d9cd1e074f8f7ce7af6148801a806b64608019b0159b5e.exe	28
PID 1956 wrote to memory of 1988	1956	a60bb9ee906a7ca067d9cd1e074f8f7ce7af6148801a806b64608019b0159b5e.exe	28
PID 1956 wrote to memory of 1988	1956	a60bb9ee906a7ca067d9cd1e074f8f7ce7af6148801a806b64608019b0159b5e.exe	28
PID 1956 wrote to memory of 1988	1956	a60bb9ee906a7ca067d9cd1e074f8f7ce7af6148801a806b64608019b0159b5e.exe	28

C:\Users\Admin\AppData\Local\Temp\a60bb9ee906a7ca067d9cd1e074f8f7ce7af6148801a806b64608019b0159b5e.exe
"C:\Users\Admin\AppData\Local\Temp\a60bb9ee906a7ca067d9cd1e074f8f7ce7af6148801a806b64608019b0159b5e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 200
  2⤵
  - Program crash
  PID:1988

memory/1956-0-0x0000000000400000-0x0000000001831000-memory.dmp

Filesize
20.2MB

Download
memory/1956-1-0x0000000000400000-0x0000000001831000-memory.dmp

Filesize
20.2MB

Download