1aabc291b910d51719c3f0fe074f4f284c160796d10d4d2a46acb3c64239449e

Analysis

max time kernel
121s
max time network
138s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01-11-2023 12:36

Target

6631a01942a28fc0507a84c854310df8.exe
Size

1.4MB
MD5

6631a01942a28fc0507a84c854310df8
SHA1

fc2075746a83511aa2e01409b4e8f9420af88625
SHA256

ae711943280a10e5296a2cf63302dbf4cfbec2cd1969346a9ced66085459f22c
SHA512

da9c001d355b493f9fe258f145d60afa35f3696859909e58069395f47fa1bcfa48e631e73cc235672518b2ae1c863ec8632e63a8fdc4ac9281debef8623ab9fa
SSDEEP

24576:sdAKF3zI//5CLMIlAXRZNqqk84BavP6bDK3k9mLX6f1XdshwMtBMeP4V56MoUi0V:s1F3iYmXRZNqqk84BavP6bDK3k9yX6f7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2192	1296	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 2192	1296	6631a01942a28fc0507a84c854310df8.exe	27
PID 1296 wrote to memory of 2192	1296	6631a01942a28fc0507a84c854310df8.exe	27
PID 1296 wrote to memory of 2192	1296	6631a01942a28fc0507a84c854310df8.exe	27
PID 1296 wrote to memory of 2192	1296	6631a01942a28fc0507a84c854310df8.exe	27

C:\Users\Admin\AppData\Local\Temp\6631a01942a28fc0507a84c854310df8.exe
"C:\Users\Admin\AppData\Local\Temp\6631a01942a28fc0507a84c854310df8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 540
  2⤵
  - Program crash
  PID:2192

memory/1296-1-0x0000000000B20000-0x0000000000C84000-memory.dmp

Filesize
1.4MB

Download
memory/1296-0-0x0000000073DF0000-0x00000000744DE000-memory.dmp

Filesize
6.9MB

Download
memory/1296-2-0x0000000073DF0000-0x00000000744DE000-memory.dmp

Filesize
6.9MB

Download