e6609799fe0ad1c0196a116c83f854c37cd29a416334c917f52ad39dac250a63

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 01:24

Target

e6609799fe0ad1c0196a116c83f854c37cd29a416334c917f52ad39dac250a63.exe
Size

2.2MB
MD5

d3f5e6e29934ec3239d5b72ed5254ccc
SHA1

39eef194e878b21b7b7f3259ac12945cdee03c25
SHA256

e6609799fe0ad1c0196a116c83f854c37cd29a416334c917f52ad39dac250a63
SHA512

1288e9639b692b2171602a7ce7b3c39748c1acc6b85f7dbba08416d65eaa9dd1cadb601f4f93a67248a4a7843fd57ffe885463e6341e24e3398501020fd5c36a
SSDEEP

24576:/vhzy3cHoORwqetii6hsuiWHBzy3cHoORwqetii6hsuiWUgMASxuTmzMcgi:/GiohGuiohXgSxuTmIc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2904	1956	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2904	1956	e6609799fe0ad1c0196a116c83f854c37cd29a416334c917f52ad39dac250a63.exe	28
PID 1956 wrote to memory of 2904	1956	e6609799fe0ad1c0196a116c83f854c37cd29a416334c917f52ad39dac250a63.exe	28
PID 1956 wrote to memory of 2904	1956	e6609799fe0ad1c0196a116c83f854c37cd29a416334c917f52ad39dac250a63.exe	28
PID 1956 wrote to memory of 2904	1956	e6609799fe0ad1c0196a116c83f854c37cd29a416334c917f52ad39dac250a63.exe	28

C:\Users\Admin\AppData\Local\Temp\e6609799fe0ad1c0196a116c83f854c37cd29a416334c917f52ad39dac250a63.exe
"C:\Users\Admin\AppData\Local\Temp\e6609799fe0ad1c0196a116c83f854c37cd29a416334c917f52ad39dac250a63.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 532
  2⤵
  - Program crash
  PID:2904

memory/1956-1-0x00000000747C0000-0x0000000074EAE000-memory.dmp

Filesize
6.9MB

Download
memory/1956-0-0x00000000009F0000-0x0000000000C20000-memory.dmp

Filesize
2.2MB

Download
memory/1956-2-0x00000000747C0000-0x0000000074EAE000-memory.dmp

Filesize
6.9MB

Download