f866da9975219e1e528e46bc0ef69d4c640e9d63df4c5344325bf7678ec966d2

Analysis

max time kernel
121s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 18:40

Target

00bf6c43a7cb0ec7d85678899834fe9a.exe
Size

368KB
MD5

00bf6c43a7cb0ec7d85678899834fe9a
SHA1

50844b5611f09271af84d2bbc1a9c6dfc483c705
SHA256

f866da9975219e1e528e46bc0ef69d4c640e9d63df4c5344325bf7678ec966d2
SHA512

a72d681772f892fa87c0de921430ca72557a2ac5cc0720b9ae5b1b0da0a2c3c629d09c3ef0d31ed1212bac8f5bc7d42feb20ee099b8f662a6610d0f056965c3e
SSDEEP

6144:RTAp4naqm5GR/0N4Ftn6vicI8qtQQenKDFujBeqSDgzB8jk3c:R041m5Q/0N4L9xYus1NSD2Cg3c

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2692	2384	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2692	2384	00bf6c43a7cb0ec7d85678899834fe9a.exe	30
PID 2384 wrote to memory of 2692	2384	00bf6c43a7cb0ec7d85678899834fe9a.exe	30
PID 2384 wrote to memory of 2692	2384	00bf6c43a7cb0ec7d85678899834fe9a.exe	30
PID 2384 wrote to memory of 2692	2384	00bf6c43a7cb0ec7d85678899834fe9a.exe	30

C:\Users\Admin\AppData\Local\Temp\00bf6c43a7cb0ec7d85678899834fe9a.exe
"C:\Users\Admin\AppData\Local\Temp\00bf6c43a7cb0ec7d85678899834fe9a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 116
  2⤵
  - Program crash
  PID:2692

memory/2384-0-0x0000000000870000-0x00000000008D0000-memory.dmp

Filesize
384KB

Download