0b6db9ce64567ce9475b65e79f9791464999da8d4e0cfbe30b98039fd362597c

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 12:23

Target

6e3b1a40edf79de53a84755d58c31329.exe
Size

55KB
MD5

6e3b1a40edf79de53a84755d58c31329
SHA1

7322960bbfa559132d819768e8c29e72929f4394
SHA256

0b6db9ce64567ce9475b65e79f9791464999da8d4e0cfbe30b98039fd362597c
SHA512

f22e6d4b7a54faf285bb5c5fd6d3fc112139f704377c708d8e9ce48e85b6a728116b9ba8203f9a94f298e03cfba6a1c33ba210ae8a1b1b22ac3d56b3e35e5006
SSDEEP

1536:cGw/573Bm8oc+7OyMbkrnQkluWT5eO40kUSXx2LN:hw/573Bm8oc+iBbkrluWT5eONSaN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3064	1364	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 3064	1364	6e3b1a40edf79de53a84755d58c31329.exe	15
PID 1364 wrote to memory of 3064	1364	6e3b1a40edf79de53a84755d58c31329.exe	15
PID 1364 wrote to memory of 3064	1364	6e3b1a40edf79de53a84755d58c31329.exe	15
PID 1364 wrote to memory of 3064	1364	6e3b1a40edf79de53a84755d58c31329.exe	15

C:\Users\Admin\AppData\Local\Temp\6e3b1a40edf79de53a84755d58c31329.exe
"C:\Users\Admin\AppData\Local\Temp\6e3b1a40edf79de53a84755d58c31329.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 140
  2⤵
  - Program crash
  PID:3064

memory/1364-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1364-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download