5c70926f7cb0cca0cab5100dedc8bafba9b08480939e61f13874f43848012348

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 12:41

Target

6f46a234155775ee6611cdb2fb645d5d.exe
Size

430KB
MD5

6f46a234155775ee6611cdb2fb645d5d
SHA1

b8c6156d919c66d4f79bac92083dffb5b50a8485
SHA256

5c70926f7cb0cca0cab5100dedc8bafba9b08480939e61f13874f43848012348
SHA512

10bda8920734d24d6ba769f764cc136ea092217158265632f05114382ccbed8eed83842906465d09b082bc4474c5b4a799587f026fef62be5f544dce5d17cf65
SSDEEP

6144:Ulsy4TNbEm1B1zzqaCh9Ju/2x+vw0b8ajNglS2+gUXpP9YC4r3:UdwNIm1B1zzqrh9Jf+btwSfgUnBI3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2116	1456	WerFault.exe	12

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 2116	1456	6f46a234155775ee6611cdb2fb645d5d.exe	28
PID 1456 wrote to memory of 2116	1456	6f46a234155775ee6611cdb2fb645d5d.exe	28
PID 1456 wrote to memory of 2116	1456	6f46a234155775ee6611cdb2fb645d5d.exe	28
PID 1456 wrote to memory of 2116	1456	6f46a234155775ee6611cdb2fb645d5d.exe	28

C:\Users\Admin\AppData\Local\Temp\6f46a234155775ee6611cdb2fb645d5d.exe
"C:\Users\Admin\AppData\Local\Temp\6f46a234155775ee6611cdb2fb645d5d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 116
  2⤵
  - Program crash
  PID:2116

memory/1456-0-0x0000000000200000-0x0000000000270000-memory.dmp

Filesize
448KB

Download