6d9ea09f26334451db6155401073801ebe927baa5a293b78022394ca056323ca

Analysis

max time kernel
117s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:34

Target

285ab2b0d3e67bd1c59ffc1609e264d8.exe
Size

150KB
MD5

285ab2b0d3e67bd1c59ffc1609e264d8
SHA1

531b6951d4266a85eacf1a0857a71557237566d8
SHA256

6d9ea09f26334451db6155401073801ebe927baa5a293b78022394ca056323ca
SHA512

056fa2f1c974ff5bc72d0922038d7a7dbd1ab3dab9248f446fbf3da92cafc5ffe57a29b81b50c3c8c3a1500fd1d6e1cccc23d5896263e4e0985bdf38bc32106f
SSDEEP

3072:Pdu2Nm30xilke69OpmoWOQQtfAcxMKyzzyrlNMa8jSDtBkivlL5KPN:Pdc+9O4oWOQUfJWtePMa6AtvvlL5K1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1060	2224	WerFault.exe	23

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1060	2224	285ab2b0d3e67bd1c59ffc1609e264d8.exe	28
PID 2224 wrote to memory of 1060	2224	285ab2b0d3e67bd1c59ffc1609e264d8.exe	28
PID 2224 wrote to memory of 1060	2224	285ab2b0d3e67bd1c59ffc1609e264d8.exe	28
PID 2224 wrote to memory of 1060	2224	285ab2b0d3e67bd1c59ffc1609e264d8.exe	28
PID 2224 wrote to memory of 1060	2224	285ab2b0d3e67bd1c59ffc1609e264d8.exe	28
PID 2224 wrote to memory of 1060	2224	285ab2b0d3e67bd1c59ffc1609e264d8.exe	28
PID 2224 wrote to memory of 1060	2224	285ab2b0d3e67bd1c59ffc1609e264d8.exe	28

C:\Users\Admin\AppData\Local\Temp\285ab2b0d3e67bd1c59ffc1609e264d8.exe
"C:\Users\Admin\AppData\Local\Temp\285ab2b0d3e67bd1c59ffc1609e264d8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 256
  2⤵
  - Program crash
  PID:1060