52da9805c6925673d69660c49e40ce3aa83df0cc58f1552259f16021adfe6e24

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 12:43

Target

6f65f04eebbd7cf713879cba9be7628f.exe
Size

509KB
MD5

6f65f04eebbd7cf713879cba9be7628f
SHA1

a016479ff716a325498265abee5b1e537bc95794
SHA256

52da9805c6925673d69660c49e40ce3aa83df0cc58f1552259f16021adfe6e24
SHA512

70a538a8235cd732029c731996787581b449b2b5105c073b693cd128eca9531bccf0ca09166c277164d41a29d62fe5028d29154e2a39a7ced269badf0408f819
SSDEEP

6144:VDJnTMvJl2qTorpB79W8PjOuU33XaCj0U0RordEq+7WDRwwG2OsFhF+39GH9Jg3g:VdnsFq9WR3XaCj0xudNBrOEFn3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2028	2348	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2028	2348	6f65f04eebbd7cf713879cba9be7628f.exe	28
PID 2348 wrote to memory of 2028	2348	6f65f04eebbd7cf713879cba9be7628f.exe	28
PID 2348 wrote to memory of 2028	2348	6f65f04eebbd7cf713879cba9be7628f.exe	28
PID 2348 wrote to memory of 2028	2348	6f65f04eebbd7cf713879cba9be7628f.exe	28

C:\Users\Admin\AppData\Local\Temp\6f65f04eebbd7cf713879cba9be7628f.exe
"C:\Users\Admin\AppData\Local\Temp\6f65f04eebbd7cf713879cba9be7628f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 156
  2⤵
  - Program crash
  PID:2028

memory/2348-0-0x0000000000FB0000-0x0000000001032000-memory.dmp

Filesize
520KB

Download