73ee6eb846f18354048bcfd96fae8168ab225f66b72bc9479805ab1d31a819e2

Analysis

max time kernel
142s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 10:48

Target

6890cc352c118c9d627f57d0bb57d635.exe
Size

134KB
MD5

6890cc352c118c9d627f57d0bb57d635
SHA1

a15c56b5349f105a6378d6213f14b3211a215047
SHA256

73ee6eb846f18354048bcfd96fae8168ab225f66b72bc9479805ab1d31a819e2
SHA512

55ec505078dfe064b23d1de3e79cef8f85cb8049062738e47c6333d7d2d900b2aba3e574b51bffb6fde8c4a79585b39569c4acaa23af974107143ed71034b1ed
SSDEEP

3072:pVz8NPIGuusg74pLBD47NFPfK6xjcJf6eBHTBfb82H9:pF83H74px47zs6AHTBj82d

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2356	2760	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2356	2760	6890cc352c118c9d627f57d0bb57d635.exe	28
PID 2760 wrote to memory of 2356	2760	6890cc352c118c9d627f57d0bb57d635.exe	28
PID 2760 wrote to memory of 2356	2760	6890cc352c118c9d627f57d0bb57d635.exe	28
PID 2760 wrote to memory of 2356	2760	6890cc352c118c9d627f57d0bb57d635.exe	28

C:\Users\Admin\AppData\Local\Temp\6890cc352c118c9d627f57d0bb57d635.exe
"C:\Users\Admin\AppData\Local\Temp\6890cc352c118c9d627f57d0bb57d635.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 148
  2⤵
  - Program crash
  PID:2356

memory/2760-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download