6b900badfbd076bdf8120d7dc78778b6fe7b67283e1506b318551e27c5ca1b43

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:09

Target

0ff0568f320e3c9b898e4b802faa86c5.exe
Size

422KB
MD5

0ff0568f320e3c9b898e4b802faa86c5
SHA1

f5749139e4f45f3260896df9d2f14ded9e27eeee
SHA256

6b900badfbd076bdf8120d7dc78778b6fe7b67283e1506b318551e27c5ca1b43
SHA512

aab33044824b81cdef9fcd8f403621a65950059ee4c3a9128960a42bc1a0d39bb3e64e7851518c1a63eec41497e941b84759448c113554f04b8f0d33929594c8
SSDEEP

6144:ykB1INZdWaFzaE7mDGg7Y4+MFyBPys80G5sEOi9Ri9na5UVx3:ykBgdW/E7mDGg8xMkBp80GiZa5UVh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2328	2364	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2328	2364	0ff0568f320e3c9b898e4b802faa86c5.exe	28
PID 2364 wrote to memory of 2328	2364	0ff0568f320e3c9b898e4b802faa86c5.exe	28
PID 2364 wrote to memory of 2328	2364	0ff0568f320e3c9b898e4b802faa86c5.exe	28
PID 2364 wrote to memory of 2328	2364	0ff0568f320e3c9b898e4b802faa86c5.exe	28

C:\Users\Admin\AppData\Local\Temp\0ff0568f320e3c9b898e4b802faa86c5.exe
"C:\Users\Admin\AppData\Local\Temp\0ff0568f320e3c9b898e4b802faa86c5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 116
  2⤵
  - Program crash
  PID:2328

memory/2364-0-0x0000000000A30000-0x0000000000A9E000-memory.dmp

Filesize
440KB

Download