6ee692954e357159b9287290b1678adb46e7fab31ef3bc8b57e0fe0ea44cb2ea

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 00:30

Target

21c6ad1816ff98cda60086e78c7abeb8.exe
Size

348KB
MD5

21c6ad1816ff98cda60086e78c7abeb8
SHA1

be4f2a02d293d2f6722c64aa20ee5d6c29035142
SHA256

6ee692954e357159b9287290b1678adb46e7fab31ef3bc8b57e0fe0ea44cb2ea
SHA512

1bca16d92a0d456166d2ea56438fa76bcb8e3cc833478ad502e0088de2285e63e5cfd0262d70a8a751e92d7272e9bafa3c81f59e87740e77bf008f8756659c93
SSDEEP

768:rt0K29LHBmHY178Z85KZYdLNKDlox+s17pGAymPmGP6xFD1cUj8f/zXgggeDqm:rD2mHc7W85KZdBox+s17QmdP6XORNgFm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1932	2204	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1932	2204	21c6ad1816ff98cda60086e78c7abeb8.exe	28
PID 2204 wrote to memory of 1932	2204	21c6ad1816ff98cda60086e78c7abeb8.exe	28
PID 2204 wrote to memory of 1932	2204	21c6ad1816ff98cda60086e78c7abeb8.exe	28
PID 2204 wrote to memory of 1932	2204	21c6ad1816ff98cda60086e78c7abeb8.exe	28

C:\Users\Admin\AppData\Local\Temp\21c6ad1816ff98cda60086e78c7abeb8.exe
"C:\Users\Admin\AppData\Local\Temp\21c6ad1816ff98cda60086e78c7abeb8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 36
  2⤵
  - Program crash
  PID:1932

memory/2204-0-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download