43ed2416abca0b169531e31b04edc101c957a7f020db7bfb50440e9a08cbee04

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 11:23

Target

6a88be9a900d8e716d7ebd95c6fb961f.exe
Size

259KB
MD5

6a88be9a900d8e716d7ebd95c6fb961f
SHA1

81d51634afa8793009c14bc02834bcdc14cffff4
SHA256

43ed2416abca0b169531e31b04edc101c957a7f020db7bfb50440e9a08cbee04
SHA512

803e3609108de9284191443e424cc4b51b0bb3f081dc0442e045a9d7d40e131410316671cb636d37be943a097d3f12d9b18173ca66df150567f86b942c673775
SSDEEP

3072:6PKzYumNZ2yctvBmrqz+kxY7DyDwH/Pmv53WUPEi1qdCSG7LIscHMrsQ01nZxnij:6PKzdyctYrT7/PsW8EZd40seWs9Zxip

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3048	2004	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 3048	2004	6a88be9a900d8e716d7ebd95c6fb961f.exe	14
PID 2004 wrote to memory of 3048	2004	6a88be9a900d8e716d7ebd95c6fb961f.exe	14
PID 2004 wrote to memory of 3048	2004	6a88be9a900d8e716d7ebd95c6fb961f.exe	14
PID 2004 wrote to memory of 3048	2004	6a88be9a900d8e716d7ebd95c6fb961f.exe	14

C:\Users\Admin\AppData\Local\Temp\6a88be9a900d8e716d7ebd95c6fb961f.exe
"C:\Users\Admin\AppData\Local\Temp\6a88be9a900d8e716d7ebd95c6fb961f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 88
  2⤵
  - Program crash
  PID:3048

memory/2004-0-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download