e1f8678d3bf3bfa9d1e7e82699a47c350ccbcaff66287a19a342c9d4b5b8af21

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-01-2024 18:16

Target

6ffa8b30e4f6d78b8e8d7add4ae59d0a.exe
Size

77KB
MD5

6ffa8b30e4f6d78b8e8d7add4ae59d0a
SHA1

677dcc7a8e1ff03a54808ec1f21da63d9abe065f
SHA256

e1f8678d3bf3bfa9d1e7e82699a47c350ccbcaff66287a19a342c9d4b5b8af21
SHA512

064be55443f67435847a73c197e3a2a855cc7906ef38fd878f6422f37b0036191ffeff9f5fff4eddae1bf6b747d8f5bcfe4c61ac9135c3255e0423ca441e1536
SSDEEP

1536:3KBEVJ8M4531nePBwDYZldB5+1q3EBQizQdc+n5rdBJVl2MCITnE:3KBLxvgUyTyyEB5zQdc+n5rzJVljE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2948	2188	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2948	2188	6ffa8b30e4f6d78b8e8d7add4ae59d0a.exe	28
PID 2188 wrote to memory of 2948	2188	6ffa8b30e4f6d78b8e8d7add4ae59d0a.exe	28
PID 2188 wrote to memory of 2948	2188	6ffa8b30e4f6d78b8e8d7add4ae59d0a.exe	28
PID 2188 wrote to memory of 2948	2188	6ffa8b30e4f6d78b8e8d7add4ae59d0a.exe	28

C:\Users\Admin\AppData\Local\Temp\6ffa8b30e4f6d78b8e8d7add4ae59d0a.exe
"C:\Users\Admin\AppData\Local\Temp\6ffa8b30e4f6d78b8e8d7add4ae59d0a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 220
  2⤵
  - Program crash
  PID:2948

memory/2188-0-0x0000000000930000-0x00000000009FC000-memory.dmp

Filesize
816KB

Download
memory/2188-1-0x00000000007B0000-0x0000000000860000-memory.dmp

Filesize
704KB

Download
memory/2188-2-0x0000000000930000-0x00000000009FC000-memory.dmp

Filesize
816KB

Download