06a45e594bd46b09662e9b74447b828accc1fb1830d228c3fe878266ee64e961

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:24

Target

29e6989cc93e20b458701c3967838cf8.exe
Size

232KB
MD5

29e6989cc93e20b458701c3967838cf8
SHA1

532100ec602285241633f2d02c9b07ec7f4fcb7b
SHA256

06a45e594bd46b09662e9b74447b828accc1fb1830d228c3fe878266ee64e961
SHA512

7f4d8ef5e8d14051c3ad9569b026325d781e5175954ffa7434d8945427a314c739689484d8e6031c62e4ce077f7d9683e0c9003119e88ca70a764aadbd83732e
SSDEEP

6144:MZkB8wb2OV830rKyhcrx7eOTpwOSMfOVAnsDMcAE/frs:+wb83Avcrx7JTi9MfeAsDOmjs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2028	2236	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2028	2236	29e6989cc93e20b458701c3967838cf8.exe	14
PID 2236 wrote to memory of 2028	2236	29e6989cc93e20b458701c3967838cf8.exe	14
PID 2236 wrote to memory of 2028	2236	29e6989cc93e20b458701c3967838cf8.exe	14
PID 2236 wrote to memory of 2028	2236	29e6989cc93e20b458701c3967838cf8.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 104
1⤵
- Program crash
PID:2028

C:\Users\Admin\AppData\Local\Temp\29e6989cc93e20b458701c3967838cf8.exe
"C:\Users\Admin\AppData\Local\Temp\29e6989cc93e20b458701c3967838cf8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2236

memory/2236-0-0x0000000000EF0000-0x0000000000F02000-memory.dmp

Filesize
72KB

Download
memory/2236-1-0x0000000000EF0000-0x0000000000F02000-memory.dmp

Filesize
72KB

Download