632ce1dd12cf4820850ba1024836787fa9ba1394d4f71192353499c47d5bb671

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 12:12

Target

6d7d9c1f639d343b65a5659741d9d162.exe
Size

422KB
MD5

6d7d9c1f639d343b65a5659741d9d162
SHA1

822368126603d2cc0f9936ab5ecf9de57951e2a3
SHA256

632ce1dd12cf4820850ba1024836787fa9ba1394d4f71192353499c47d5bb671
SHA512

75c7ba67183f5274392579f7e26c5373278383d574848766671d0d749620290fae99669fccdbb71556ae81f25be297d443904b796c8ec91929a55ab859cbaf23
SSDEEP

6144:ykB1INZdWaFzaE7mDGg7Y4+MFyBPys80G5sEOi9Ri9na5UVx3:ykBgdW/E7mDGg8xMkBp80GiZa5UVh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2872	2792	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2872	2792	6d7d9c1f639d343b65a5659741d9d162.exe	27
PID 2792 wrote to memory of 2872	2792	6d7d9c1f639d343b65a5659741d9d162.exe	27
PID 2792 wrote to memory of 2872	2792	6d7d9c1f639d343b65a5659741d9d162.exe	27
PID 2792 wrote to memory of 2872	2792	6d7d9c1f639d343b65a5659741d9d162.exe	27

C:\Users\Admin\AppData\Local\Temp\6d7d9c1f639d343b65a5659741d9d162.exe
"C:\Users\Admin\AppData\Local\Temp\6d7d9c1f639d343b65a5659741d9d162.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 116
  2⤵
  - Program crash
  PID:2872

memory/2792-0-0x00000000009B0000-0x0000000000A1E000-memory.dmp

Filesize
440KB

Download