8c80f82075cb6aceea812eb06530cb8c374414e7cb0061d7c874ae3f2092c236

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:06

Target

1f6aaf1998444e061a2327b6830794e1.exe
Size

17KB
MD5

1f6aaf1998444e061a2327b6830794e1
SHA1

e3e9719de8decba3b4795378c9dfe14075b550da
SHA256

8c80f82075cb6aceea812eb06530cb8c374414e7cb0061d7c874ae3f2092c236
SHA512

370502a4782f1c20cd1365cbfb35fa69f2ad59e1c28ff5012f5743aaa28386115660afa16710e374a1200d33e08c488d4b5fd7ec2ceedb2e7dc1fb10db93984a
SSDEEP

192:ndBLXX2z/vW5kAFTmqep6HdgGVHleASenDgIkBN/GRtE1J0cZfPLv2Wr3z/SuHDm:PkANmRp69g2MTxIil/1KzDFlv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2304	2088	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2304	2088	1f6aaf1998444e061a2327b6830794e1.exe	28
PID 2088 wrote to memory of 2304	2088	1f6aaf1998444e061a2327b6830794e1.exe	28
PID 2088 wrote to memory of 2304	2088	1f6aaf1998444e061a2327b6830794e1.exe	28
PID 2088 wrote to memory of 2304	2088	1f6aaf1998444e061a2327b6830794e1.exe	28

C:\Users\Admin\AppData\Local\Temp\1f6aaf1998444e061a2327b6830794e1.exe
"C:\Users\Admin\AppData\Local\Temp\1f6aaf1998444e061a2327b6830794e1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 36
  2⤵
  - Program crash
  PID:2304