f49b4999db454c7d828f1829b6756463980264794f532a083c8529d3d95d9aaa

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 04:02

Target

6469b30499f87ac3b223783ffb6e5500.exe
Size

23KB
MD5

6469b30499f87ac3b223783ffb6e5500
SHA1

133cc93135c6e614f37c95ef2b8d314c61766742
SHA256

f49b4999db454c7d828f1829b6756463980264794f532a083c8529d3d95d9aaa
SHA512

133a1d21c3842c09903801a4826ec7930f062e89db4738911813e8e9da67ffa4352cb842006d74b782e7eda81184ae6d07305f6fa55100cd18381fb4df34c9ba
SSDEEP

384:dcSlSsGWLY6vE6HwWNdmfqWILd1vjWCDQxzrQ6/eZyO5QyNTlSOz+:dcuQWc6vH3dJWC0xz06WZz1S

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2424	2332	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2424	2332	6469b30499f87ac3b223783ffb6e5500.exe	28
PID 2332 wrote to memory of 2424	2332	6469b30499f87ac3b223783ffb6e5500.exe	28
PID 2332 wrote to memory of 2424	2332	6469b30499f87ac3b223783ffb6e5500.exe	28
PID 2332 wrote to memory of 2424	2332	6469b30499f87ac3b223783ffb6e5500.exe	28

C:\Users\Admin\AppData\Local\Temp\6469b30499f87ac3b223783ffb6e5500.exe
"C:\Users\Admin\AppData\Local\Temp\6469b30499f87ac3b223783ffb6e5500.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 88
  2⤵
  - Program crash
  PID:2424

memory/2332-0-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download