2f085e3cd80b05d74d76e5dc0490fe580da1322f222023e6f4c9d00ab693684c

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-01-2024 15:10

Target

6fbffba27a60723a7e7ca08b536f9847.exe
Size

355KB
MD5

6fbffba27a60723a7e7ca08b536f9847
SHA1

65dd1e7443543862026dbaafdec690d3b778e44d
SHA256

2f085e3cd80b05d74d76e5dc0490fe580da1322f222023e6f4c9d00ab693684c
SHA512

4ffb5c83e1a11f0bd01f0d0a80d223647a60285b5f378dec948ed6d8c2a416bba7395eb9add398a7fbb6365aa6b7ee18501b67625f590cfbee446f76773d5d14
SSDEEP

6144:M3iMDxaoOHB0uK0Cmo3DRvGv3tJEYhre+mwwj/JWFT6vsGsXyUp2Yq30gMPULs:QTOhlXqDRa3tJLhK/cJNFXR2Yi7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2000	2912	WerFault.exe	2

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2000	2912	6fbffba27a60723a7e7ca08b536f9847.exe	28
PID 2912 wrote to memory of 2000	2912	6fbffba27a60723a7e7ca08b536f9847.exe	28
PID 2912 wrote to memory of 2000	2912	6fbffba27a60723a7e7ca08b536f9847.exe	28
PID 2912 wrote to memory of 2000	2912	6fbffba27a60723a7e7ca08b536f9847.exe	28

C:\Users\Admin\AppData\Local\Temp\6fbffba27a60723a7e7ca08b536f9847.exe
"C:\Users\Admin\AppData\Local\Temp\6fbffba27a60723a7e7ca08b536f9847.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 148
  2⤵
  - Program crash
  PID:2000

memory/2912-0-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download