949fdec25840a25090763d7ae0bdb312dc84ea4c49d2bef85af9cad1a109387a

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 06:25

Target

11061646ed17a3dce702983f066a56d3.exe
Size

74KB
MD5

11061646ed17a3dce702983f066a56d3
SHA1

6fb2be13176df24d6e209f94aa7fdd7e4603699b
SHA256

949fdec25840a25090763d7ae0bdb312dc84ea4c49d2bef85af9cad1a109387a
SHA512

80efe1e0516c724e321967191a00a24247062f81fcb51a5210dd962a744ae5346ea42c41ebfb524d6a538bd0331d1eb56e33aaf65522f3906c66ce02b86e9155
SSDEEP

1536:6+5TO6GGe1RuSE3fTwc/eBRU9JTLfcLHtz37DVzer1W+TA+Tx+Tu+TAFCT:6f6Re1ZSw9RU3LfALnhG1WSASxSuSAFO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2216	2880	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2216	2880	11061646ed17a3dce702983f066a56d3.exe	28
PID 2880 wrote to memory of 2216	2880	11061646ed17a3dce702983f066a56d3.exe	28
PID 2880 wrote to memory of 2216	2880	11061646ed17a3dce702983f066a56d3.exe	28
PID 2880 wrote to memory of 2216	2880	11061646ed17a3dce702983f066a56d3.exe	28

C:\Users\Admin\AppData\Local\Temp\11061646ed17a3dce702983f066a56d3.exe
"C:\Users\Admin\AppData\Local\Temp\11061646ed17a3dce702983f066a56d3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 36
  2⤵
  - Program crash
  PID:2216