33e3b3fe14350d8c7dacd628c5287ae37341f435001d0811e42777adfa987ff1

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 12:29

Target

6e9c14a85f6bbd727f12030f14297635.exe
Size

76KB
MD5

6e9c14a85f6bbd727f12030f14297635
SHA1

023984ea0919b62bd2af77f43b2823fee97168bf
SHA256

33e3b3fe14350d8c7dacd628c5287ae37341f435001d0811e42777adfa987ff1
SHA512

e97e1e3de4a8cc720ca63db6c61ce21103a39978ed135e3daf40ba1c4c02d6d8a3fdaabd7b027143a1ad9907f7f3549d354e7f2b9aea46a2061ceddd00e333b4
SSDEEP

1536:Ju2IPz5Nrrx+ZpOok1npzyqWyxk0/PgzhKb+pjVrs2ryrd1vUQuq6:Ju2e1mjinByq51/jCHs2qo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2080	1848	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2080	1848	6e9c14a85f6bbd727f12030f14297635.exe	28
PID 1848 wrote to memory of 2080	1848	6e9c14a85f6bbd727f12030f14297635.exe	28
PID 1848 wrote to memory of 2080	1848	6e9c14a85f6bbd727f12030f14297635.exe	28
PID 1848 wrote to memory of 2080	1848	6e9c14a85f6bbd727f12030f14297635.exe	28

C:\Users\Admin\AppData\Local\Temp\6e9c14a85f6bbd727f12030f14297635.exe
"C:\Users\Admin\AppData\Local\Temp\6e9c14a85f6bbd727f12030f14297635.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 36
  2⤵
  - Program crash
  PID:2080

memory/1848-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download