af2407de50f7aa1a858fb189eb6e644bfd3eb547a223366a1ea3d4c8f2718d9d

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 20:05

Target

0fb6fc80d06ab48533ae4fda8a54406d.exe
Size

78KB
MD5

0fb6fc80d06ab48533ae4fda8a54406d
SHA1

b8dd7b9324e7164ec417fa361ca505be381d83d7
SHA256

af2407de50f7aa1a858fb189eb6e644bfd3eb547a223366a1ea3d4c8f2718d9d
SHA512

c7696222b5e112c4616affa1fcf7d59fa9d03ef5c355a672ee1b999e5b4c77ffa576df8c22a5937fca0b501b6cf58a1d0ffbf379566f0fa74308a1b3a5b0150c
SSDEEP

1536:/5p8C8Y+OJgAA6NX4hY/jxdAzMiEcanEoQ0qsMiomJlIK:wCd+XAAoHAgiEcboR8iomJlIK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1540	2164	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 1540	2164	0fb6fc80d06ab48533ae4fda8a54406d.exe	28
PID 2164 wrote to memory of 1540	2164	0fb6fc80d06ab48533ae4fda8a54406d.exe	28
PID 2164 wrote to memory of 1540	2164	0fb6fc80d06ab48533ae4fda8a54406d.exe	28
PID 2164 wrote to memory of 1540	2164	0fb6fc80d06ab48533ae4fda8a54406d.exe	28

C:\Users\Admin\AppData\Local\Temp\0fb6fc80d06ab48533ae4fda8a54406d.exe
"C:\Users\Admin\AppData\Local\Temp\0fb6fc80d06ab48533ae4fda8a54406d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 152
  2⤵
  - Program crash
  PID:1540