6ba52b01429c4536807235e1ab755a8a8b2534f289b0ed1598219867dd0ce8d1

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 01:10

Target

09a0c706cf1387bc6ce4d3d8e0562694.exe
Size

9KB
MD5

09a0c706cf1387bc6ce4d3d8e0562694
SHA1

6290e5b500af3d88ae91550cc312c674eacb90b5
SHA256

6ba52b01429c4536807235e1ab755a8a8b2534f289b0ed1598219867dd0ce8d1
SHA512

1a1fa0cc3c1eda48d422bd755fc5cdb9001b3f84b597747f4d32134c7d85a9e46eaf80c026a0190e20024fb2e9127fb2b5593af4cba855d663e530a26fc6bf52
SSDEEP

96:Z1Wclti9meHX1NHi9+79eQlP5VEEqls6mwx63wDlzYLfMKy9rBm9U/fKALC0rHzd:aKti9HlNaIVXqi4xDULkVrwU317Tf4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2032	2960	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2032	2960	09a0c706cf1387bc6ce4d3d8e0562694.exe	15
PID 2960 wrote to memory of 2032	2960	09a0c706cf1387bc6ce4d3d8e0562694.exe	15
PID 2960 wrote to memory of 2032	2960	09a0c706cf1387bc6ce4d3d8e0562694.exe	15
PID 2960 wrote to memory of 2032	2960	09a0c706cf1387bc6ce4d3d8e0562694.exe	15

C:\Users\Admin\AppData\Local\Temp\09a0c706cf1387bc6ce4d3d8e0562694.exe
"C:\Users\Admin\AppData\Local\Temp\09a0c706cf1387bc6ce4d3d8e0562694.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 96
  2⤵
  - Program crash
  PID:2032

memory/2960-0-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download