dc6bfed892cb0677602db54fddc49d9fc7ec0021d3d128328779b6eff8ecbe4f

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 13:35

Target

a6dd55be26949de1eb6e450f1a0ca21e.exe
Size

1.2MB
MD5

a6dd55be26949de1eb6e450f1a0ca21e
SHA1

0c0396327e0129424d8dad492177a46cc74935a6
SHA256

dc6bfed892cb0677602db54fddc49d9fc7ec0021d3d128328779b6eff8ecbe4f
SHA512

6d0018ddda9daf16d8a43503907be0d0ac96ac60e4533775e46cd0f6535f2bfd610fdd0bb80bc19e9583f421803dd33f8f16a00255274d5bc6a95a628a979ab9
SSDEEP

6144:kBHh7VXgnDzyuqtU1dYx9bxnySv+9dEr1MEspXM77NRedg7TcL/bFgcos7AyrYFL:ohVgz9BkyqACDfccge

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2856	2168	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2856	2168	a6dd55be26949de1eb6e450f1a0ca21e.exe	28
PID 2168 wrote to memory of 2856	2168	a6dd55be26949de1eb6e450f1a0ca21e.exe	28
PID 2168 wrote to memory of 2856	2168	a6dd55be26949de1eb6e450f1a0ca21e.exe	28
PID 2168 wrote to memory of 2856	2168	a6dd55be26949de1eb6e450f1a0ca21e.exe	28

C:\Users\Admin\AppData\Local\Temp\a6dd55be26949de1eb6e450f1a0ca21e.exe
"C:\Users\Admin\AppData\Local\Temp\a6dd55be26949de1eb6e450f1a0ca21e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 668
  2⤵
  - Program crash
  PID:2856

memory/2168-0-0x0000000000AB0000-0x0000000000BF4000-memory.dmp

Filesize
1.3MB

Download
memory/2168-1-0x0000000074230000-0x000000007491E000-memory.dmp

Filesize
6.9MB

Download
memory/2168-2-0x00000000020C0000-0x0000000002100000-memory.dmp

Filesize
256KB

Download
memory/2168-3-0x0000000074230000-0x000000007491E000-memory.dmp

Filesize
6.9MB

Download
memory/2168-4-0x00000000020C0000-0x0000000002100000-memory.dmp

Filesize
256KB

Download