6ad94bcea3f8f20dfe7bc1c984f0150299c660d774eb14ba6e204505090307b9

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 15:06

Target

77d3c595cb7caf65430b985f010ba771.exe
Size

16KB
MD5

77d3c595cb7caf65430b985f010ba771
SHA1

3b66c6502fa1eb83db269794ea3cf443cf9453e7
SHA256

6ad94bcea3f8f20dfe7bc1c984f0150299c660d774eb14ba6e204505090307b9
SHA512

3c99a38d0c05a1f28a905359b54ad9edc73935fbd55f23b5f74c44b1da4ed7534b5eba0a0f46a3fb6b3ed5136759b7c0c19f09b553f5884f958bb62a312e9ec4
SSDEEP

192:4W4lokL/VXLl1jEah8G+Ahb+4MMbww2U/5241T7Q:4rCkB7zjEGtvhb+80nU/5241T7Q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3068	3052	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 3068	3052	77d3c595cb7caf65430b985f010ba771.exe	16
PID 3052 wrote to memory of 3068	3052	77d3c595cb7caf65430b985f010ba771.exe	16
PID 3052 wrote to memory of 3068	3052	77d3c595cb7caf65430b985f010ba771.exe	16
PID 3052 wrote to memory of 3068	3052	77d3c595cb7caf65430b985f010ba771.exe	16

C:\Users\Admin\AppData\Local\Temp\77d3c595cb7caf65430b985f010ba771.exe
"C:\Users\Admin\AppData\Local\Temp\77d3c595cb7caf65430b985f010ba771.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 92
  2⤵
  - Program crash
  PID:3068

memory/3052-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download