65cf7e8e455c5c6a35abc9f153d2f2676fc2053f4cb1cd96700d27d5230ecd34

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 03:49

Target

669f680c1a91bc7616867ab2583ce1f1.exe
Size

136KB
MD5

669f680c1a91bc7616867ab2583ce1f1
SHA1

55f277bc55f0b6653305f63e185e62ec98cf6ffc
SHA256

65cf7e8e455c5c6a35abc9f153d2f2676fc2053f4cb1cd96700d27d5230ecd34
SHA512

626a8f3060efd0d8843eb11ef6aa13c87ebcc3a53f9d2e8d6eed36978992dee543c8b6591ea78a458966767398dd82c72162e5a33bb77da85c4be0700b435164
SSDEEP

3072:3bvLNevFjWKc0s8zjcEwOaNVcaEs2Q5M6EmEJ0r5b+lxIP1XdJ2PcD:3P6FjWb8f7wNNVms2QmKEJcP7D

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
804	2468	WerFault.exe	10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 804	2468	669f680c1a91bc7616867ab2583ce1f1.exe	28
PID 2468 wrote to memory of 804	2468	669f680c1a91bc7616867ab2583ce1f1.exe	28
PID 2468 wrote to memory of 804	2468	669f680c1a91bc7616867ab2583ce1f1.exe	28
PID 2468 wrote to memory of 804	2468	669f680c1a91bc7616867ab2583ce1f1.exe	28

C:\Users\Admin\AppData\Local\Temp\669f680c1a91bc7616867ab2583ce1f1.exe
"C:\Users\Admin\AppData\Local\Temp\669f680c1a91bc7616867ab2583ce1f1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 36
  2⤵
  - Program crash
  PID:804

memory/2468-0-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download