92b257d4d654efcea181c254e2ce4e2173528110576033e77755012769194ca7

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
17/01/2024, 20:31

Target

6389440e5fa1b208cb1428eddf19db41.exe
Size

12KB
MD5

6389440e5fa1b208cb1428eddf19db41
SHA1

61e7b9deae0b7ee76c69140a9647c26464ff30c7
SHA256

92b257d4d654efcea181c254e2ce4e2173528110576033e77755012769194ca7
SHA512

7e2fbfb43d535995985be89e2e40fa2bf325167deb01543ea4ec6cf4e6cfcd4568b1c90d71eab7f2467e817722b1649679b2f6dece7cef1962fb7391ee9b09d5
SSDEEP

96:c8ZBV5n2h/KzyiOpZjgObUK4piOdSLSbGRYw71yQtQKQYQ:cGBrn2h/WOrGMO0LSbA7MQjQYQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2544	2028	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2544	2028	6389440e5fa1b208cb1428eddf19db41.exe	14
PID 2028 wrote to memory of 2544	2028	6389440e5fa1b208cb1428eddf19db41.exe	14
PID 2028 wrote to memory of 2544	2028	6389440e5fa1b208cb1428eddf19db41.exe	14
PID 2028 wrote to memory of 2544	2028	6389440e5fa1b208cb1428eddf19db41.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 88
1⤵
- Program crash
PID:2544

C:\Users\Admin\AppData\Local\Temp\6389440e5fa1b208cb1428eddf19db41.exe
"C:\Users\Admin\AppData\Local\Temp\6389440e5fa1b208cb1428eddf19db41.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028