663bd10337642b101c536b982c16f08f933fcfb4c179871a7557e5812a04cee1

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 12:00

Target

6ccd150ccddcfd3eef48d58d91d0c2f1.exe
Size

575KB
MD5

6ccd150ccddcfd3eef48d58d91d0c2f1
SHA1

8ef91db185cc2e0cf70c3f0f469244e129e1ba33
SHA256

663bd10337642b101c536b982c16f08f933fcfb4c179871a7557e5812a04cee1
SHA512

d5956754d74b0392f3df41b34eba703c193956d28bea3f5e3f1c015021ff28f10bc7e253f2662cad093b92ac6bce3d1ada926d578689994bb4bfa70e59177f68
SSDEEP

12288:0Z1BH/A2cwLLLm/udfilv97wDrBcW2U28q7xBEoQRjBxq2hdtecHJo1j2a2s9Bgr:05H421hquSBpOBxLhdtecK1jt28gxPp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2204	628	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 2204	628	6ccd150ccddcfd3eef48d58d91d0c2f1.exe	16
PID 628 wrote to memory of 2204	628	6ccd150ccddcfd3eef48d58d91d0c2f1.exe	16
PID 628 wrote to memory of 2204	628	6ccd150ccddcfd3eef48d58d91d0c2f1.exe	16
PID 628 wrote to memory of 2204	628	6ccd150ccddcfd3eef48d58d91d0c2f1.exe	16

C:\Users\Admin\AppData\Local\Temp\6ccd150ccddcfd3eef48d58d91d0c2f1.exe
"C:\Users\Admin\AppData\Local\Temp\6ccd150ccddcfd3eef48d58d91d0c2f1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 168
  2⤵
  - Program crash
  PID:2204

memory/628-0-0x0000000000A80000-0x0000000000B13000-memory.dmp

Filesize
588KB

Download