bdb7debc5ead8736255ae99ff91b2014aa9930145a4263c55a8b38624ae4d045

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/01/2024, 17:57

Target

6ff1c146f38ddf0ee0ddcf60e9c08411.exe
Size

170KB
MD5

6ff1c146f38ddf0ee0ddcf60e9c08411
SHA1

02cc65fcc30b7e54a4d1c5eb1eeddd5f6ecab5ba
SHA256

bdb7debc5ead8736255ae99ff91b2014aa9930145a4263c55a8b38624ae4d045
SHA512

9d337ff224cc012aac33c62cd94b8bb9b843494fb3fc21a75a334d387c3850ab6964066c0fca91d4ec1481e4aa69983c1b78f018fd6f3cc209824683a6d3e820
SSDEEP

3072:YfbCNiRHVJG2NC7HXNvjQmSeQfGtPwqOo6VaLpJJ45IJbfGDS:YfbfT9OzSz8UXMLzO5E

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2384	2536	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2384	2536	6ff1c146f38ddf0ee0ddcf60e9c08411.exe	28
PID 2536 wrote to memory of 2384	2536	6ff1c146f38ddf0ee0ddcf60e9c08411.exe	28
PID 2536 wrote to memory of 2384	2536	6ff1c146f38ddf0ee0ddcf60e9c08411.exe	28
PID 2536 wrote to memory of 2384	2536	6ff1c146f38ddf0ee0ddcf60e9c08411.exe	28

C:\Users\Admin\AppData\Local\Temp\6ff1c146f38ddf0ee0ddcf60e9c08411.exe
"C:\Users\Admin\AppData\Local\Temp\6ff1c146f38ddf0ee0ddcf60e9c08411.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 36
  2⤵
  - Program crash
  PID:2384

memory/2536-0-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download