c6e49c384085d59fe9c128d5a02c9cd042f868de74688a28e7f85e0f4fb97865

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 23:21

Target

06c6bbd1e65b954df4fdea060da2f14a.exe
Size

334KB
MD5

06c6bbd1e65b954df4fdea060da2f14a
SHA1

e451d78455f95ecc6d297ace11bee0718774419e
SHA256

c6e49c384085d59fe9c128d5a02c9cd042f868de74688a28e7f85e0f4fb97865
SHA512

e0fb2a9fdf535b6d21972a711f3ef410ae17670ec127a08d3d0d6bd2b414310d24a3a40a6d561389a933cfc976f89f5c82f16d0562345c9af62a62a7506245a7
SSDEEP

6144:LioYZw2wk/D5VB8d9FHn6sLoOJLN3mdXHiZd6FPJlcUWdhD9b1HkEHY4:eoYWkBe/H6sLhdpcXHHzlcUW51EEf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2228	2648	WerFault.exe	21

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2228	2648	06c6bbd1e65b954df4fdea060da2f14a.exe	28
PID 2648 wrote to memory of 2228	2648	06c6bbd1e65b954df4fdea060da2f14a.exe	28
PID 2648 wrote to memory of 2228	2648	06c6bbd1e65b954df4fdea060da2f14a.exe	28
PID 2648 wrote to memory of 2228	2648	06c6bbd1e65b954df4fdea060da2f14a.exe	28

C:\Users\Admin\AppData\Local\Temp\06c6bbd1e65b954df4fdea060da2f14a.exe
"C:\Users\Admin\AppData\Local\Temp\06c6bbd1e65b954df4fdea060da2f14a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 36
  2⤵
  - Program crash
  PID:2228

memory/2648-0-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download