c6e0bdc33f199a0c068c97320dd4717bc136fe3c1a1304ec2ce02d7ac8bbdada

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 05:45

Target

104d5d38e42bcc3de5cc124df46f42f6.exe
Size

383KB
MD5

104d5d38e42bcc3de5cc124df46f42f6
SHA1

b2d810873882df1899a17306f6b3522f01a18695
SHA256

c6e0bdc33f199a0c068c97320dd4717bc136fe3c1a1304ec2ce02d7ac8bbdada
SHA512

71aecb28aacb05365ad503353d0d70ccf86733d44d03a417f8c7721f61372199f793f37d8f0f6b93e7c967642b5fe4ee6ba8e68d1865e94ab0bff750aafd75f6
SSDEEP

3072:22voeN+jaiG17Ef5KlrKnBZ59oZSmveDlcjIV8jlwIEU+V4EFFCcll3H3rH3XD7R:hQeNai17Y56rKnBfWhveajzxwIEU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2320	1792	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2320	1792	104d5d38e42bcc3de5cc124df46f42f6.exe	14
PID 1792 wrote to memory of 2320	1792	104d5d38e42bcc3de5cc124df46f42f6.exe	14
PID 1792 wrote to memory of 2320	1792	104d5d38e42bcc3de5cc124df46f42f6.exe	14
PID 1792 wrote to memory of 2320	1792	104d5d38e42bcc3de5cc124df46f42f6.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 100
1⤵
- Program crash
PID:2320

C:\Users\Admin\AppData\Local\Temp\104d5d38e42bcc3de5cc124df46f42f6.exe
"C:\Users\Admin\AppData\Local\Temp\104d5d38e42bcc3de5cc124df46f42f6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1792

memory/1792-0-0x000000004AD00000-0x000000004AD62000-memory.dmp

Filesize
392KB

Download
memory/1792-1-0x000000004AD00000-0x000000004AD62000-memory.dmp

Filesize
392KB

Download