e90ed8ee28041314b7a72077fdebbadfed94be1e8d97fe05c9cb0555b1f71371

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 08:31

Target

6001f1a99f08c75ff05a7a7f0a8655a1.exe
Size

76KB
MD5

6001f1a99f08c75ff05a7a7f0a8655a1
SHA1

974b54b96b40cb2211b590efd786a6e2418dc41a
SHA256

e90ed8ee28041314b7a72077fdebbadfed94be1e8d97fe05c9cb0555b1f71371
SHA512

8cc1fb9981ebc45e832d57f13d5c78a5e4a05dd072f10e9bf36f627df56c814bc7594a28ee6b990b80b66c33b2c2d8e712c798634256fe05085fa3d8f20eab57
SSDEEP

1536:e/ePyXHZ7DA4BfBrmTiXvvvUgbFNCuACP1DIgN:ceSHZ7DTBfBrB/UgbFNCuAq2C

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2156	356	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 356 wrote to memory of 2156	356	6001f1a99f08c75ff05a7a7f0a8655a1.exe	16
PID 356 wrote to memory of 2156	356	6001f1a99f08c75ff05a7a7f0a8655a1.exe	16
PID 356 wrote to memory of 2156	356	6001f1a99f08c75ff05a7a7f0a8655a1.exe	16
PID 356 wrote to memory of 2156	356	6001f1a99f08c75ff05a7a7f0a8655a1.exe	16

C:\Users\Admin\AppData\Local\Temp\6001f1a99f08c75ff05a7a7f0a8655a1.exe
"C:\Users\Admin\AppData\Local\Temp\6001f1a99f08c75ff05a7a7f0a8655a1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 356 -s 108
  2⤵
  - Program crash
  PID:2156

memory/356-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download