c6116082328d2224cb5f9c855260910b69899adc2817cb5a68293433c01a71fc

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 03:56

Target

0d9c86dee0c5e8ed74bb2df79b950aeb.exe
Size

374KB
MD5

0d9c86dee0c5e8ed74bb2df79b950aeb
SHA1

cc7cce693d61dae54260ee927cf1757928790df7
SHA256

c6116082328d2224cb5f9c855260910b69899adc2817cb5a68293433c01a71fc
SHA512

35c30ebed779a189ddbad049452e875cc940787f1769f36da2554b8f638dcbaba78aad8e68bd4af3fb583ac14442fac9674654bc87c71254a89bf9912b20a5da
SSDEEP

6144:4OwONoKK6cSmtQNIZ7xzoy9h6x8RLLYbwLyeBAOxqMaif79z6c3Dt4OYRmJ:ASK6cShezzjRn/WBuQif79z6cB4J+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2952	2116	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2952	2116	0d9c86dee0c5e8ed74bb2df79b950aeb.exe	16
PID 2116 wrote to memory of 2952	2116	0d9c86dee0c5e8ed74bb2df79b950aeb.exe	16
PID 2116 wrote to memory of 2952	2116	0d9c86dee0c5e8ed74bb2df79b950aeb.exe	16
PID 2116 wrote to memory of 2952	2116	0d9c86dee0c5e8ed74bb2df79b950aeb.exe	16

C:\Users\Admin\AppData\Local\Temp\0d9c86dee0c5e8ed74bb2df79b950aeb.exe
"C:\Users\Admin\AppData\Local\Temp\0d9c86dee0c5e8ed74bb2df79b950aeb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 44
  2⤵
  - Program crash
  PID:2952

memory/2116-0-0x0000000000570000-0x00000000005D4000-memory.dmp

Filesize
400KB

Download