54943c083bf10ebe3cbbd4c070dcc5e89c2eb7560215b33fde6de6b9669c6b7d

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 23:28

Target

06ee6f4b9a23efe2b4fc9682505cbf7e.exe
Size

106KB
MD5

06ee6f4b9a23efe2b4fc9682505cbf7e
SHA1

fbfde1ec4b7d7e61b2816ddd7ae006488a91e069
SHA256

54943c083bf10ebe3cbbd4c070dcc5e89c2eb7560215b33fde6de6b9669c6b7d
SHA512

ab9134ffcf38a2afdbd16cc63af29c424cc4eeb2a18a0ec22ec76b49eafe9c06d70821e74fac0fc7f8c4ac95b0caff88492de173934f221dbd7f786641d81775
SSDEEP

1536:/+FDoKtniY1u7Nn2JFkC2styJjCKICFjC7EWisS+5mlatSfkZ:/+FDzK71QkbstyJjCKICpC72s/mlaX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2056	1972	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2056	1972	06ee6f4b9a23efe2b4fc9682505cbf7e.exe	28
PID 1972 wrote to memory of 2056	1972	06ee6f4b9a23efe2b4fc9682505cbf7e.exe	28
PID 1972 wrote to memory of 2056	1972	06ee6f4b9a23efe2b4fc9682505cbf7e.exe	28
PID 1972 wrote to memory of 2056	1972	06ee6f4b9a23efe2b4fc9682505cbf7e.exe	28

C:\Users\Admin\AppData\Local\Temp\06ee6f4b9a23efe2b4fc9682505cbf7e.exe
"C:\Users\Admin\AppData\Local\Temp\06ee6f4b9a23efe2b4fc9682505cbf7e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 128
  2⤵
  - Program crash
  PID:2056

memory/1972-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1972-1-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download