b013a3244e192104a3ff4f26d8297a22deb0da349aabfda50dd3f6a4617e7c23

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 23:19

Target

06bb24903986c207e9a2ef5b2b98eb8c.exe
Size

46KB
MD5

06bb24903986c207e9a2ef5b2b98eb8c
SHA1

8ec346356d86dd9207da52c89bf082b01ae81868
SHA256

b013a3244e192104a3ff4f26d8297a22deb0da349aabfda50dd3f6a4617e7c23
SHA512

0501ac958f1987602763aa64b16716f8e2909bf8669153f02511ab670f0935ba4dc5ff10c67cc070fabcd0959874c6326f7d43fdfe3520df0f4f3638f152f524
SSDEEP

768:tRfG+nQLVRi8VJp3tqphhx59fIPazAkwcuC7M42fg5eTSCtWaahDgosML:to+W1p3Ez5WhkLagoThtWDDgosML

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2204	1920	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 2204	1920	06bb24903986c207e9a2ef5b2b98eb8c.exe	17
PID 1920 wrote to memory of 2204	1920	06bb24903986c207e9a2ef5b2b98eb8c.exe	17
PID 1920 wrote to memory of 2204	1920	06bb24903986c207e9a2ef5b2b98eb8c.exe	17
PID 1920 wrote to memory of 2204	1920	06bb24903986c207e9a2ef5b2b98eb8c.exe	17

C:\Users\Admin\AppData\Local\Temp\06bb24903986c207e9a2ef5b2b98eb8c.exe
"C:\Users\Admin\AppData\Local\Temp\06bb24903986c207e9a2ef5b2b98eb8c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 120
  2⤵
  - Program crash
  PID:2204