6bae58a804b62788ea7d0d651e38e51f8a2b48b0dd017366026f276491b9b0c5

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 05:01

Target

564dde7f9e2479757b02b951a154fec3.exe
Size

59KB
MD5

564dde7f9e2479757b02b951a154fec3
SHA1

1f19a4c7c1d8f65e85607ba06d8130517bf87197
SHA256

6bae58a804b62788ea7d0d651e38e51f8a2b48b0dd017366026f276491b9b0c5
SHA512

26d717d79adaae8c32eef73ad7364e88e5fc0fe2e5c949df6de9e24b71336756a8733347369259582be95845ff6ac3c15410e3e7787f2df6dd7e9ea4f84ed0b9
SSDEEP

1536:AXMMMbR1Zkey9ARTWgxaXHKU8Ji5yzfLhQL7XiFLCu2GU4mEYX:AXMMM1v3PRZ4XP+SKl6GFL92FX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2032	1860	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2032	1860	564dde7f9e2479757b02b951a154fec3.exe	28
PID 1860 wrote to memory of 2032	1860	564dde7f9e2479757b02b951a154fec3.exe	28
PID 1860 wrote to memory of 2032	1860	564dde7f9e2479757b02b951a154fec3.exe	28
PID 1860 wrote to memory of 2032	1860	564dde7f9e2479757b02b951a154fec3.exe	28

C:\Users\Admin\AppData\Local\Temp\564dde7f9e2479757b02b951a154fec3.exe
"C:\Users\Admin\AppData\Local\Temp\564dde7f9e2479757b02b951a154fec3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 92
  2⤵
  - Program crash
  PID:2032