6bfaa37599e4fcdd576168e451315c49cb66c3260cf1d455d87b373caf9d47d1

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 21:56

Target

97b465761dce2027463d0a8e6ff1ce3d.exe
Size

474KB
MD5

97b465761dce2027463d0a8e6ff1ce3d
SHA1

a13a9ab71afb90578b1e19c7b3ccf4c1e8576e1a
SHA256

6bfaa37599e4fcdd576168e451315c49cb66c3260cf1d455d87b373caf9d47d1
SHA512

7062d41d87c718b3f07a361bd803be3a472d2dcbc4dc95c5116b77abd3ea2e3ec2305220665b956ddef215040e9afb64f751a3944853cc5200bffeaa0b011595
SSDEEP

6144:KTDFRJk2a5jLzyugL7ed9MUH84TyQOI5JgpcvqNplcLab8lxMESQcd:KJB+XtT0Iw5phbqxjSQ4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2416	2116	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2416	2116	97b465761dce2027463d0a8e6ff1ce3d.exe	28
PID 2116 wrote to memory of 2416	2116	97b465761dce2027463d0a8e6ff1ce3d.exe	28
PID 2116 wrote to memory of 2416	2116	97b465761dce2027463d0a8e6ff1ce3d.exe	28
PID 2116 wrote to memory of 2416	2116	97b465761dce2027463d0a8e6ff1ce3d.exe	28

C:\Users\Admin\AppData\Local\Temp\97b465761dce2027463d0a8e6ff1ce3d.exe
"C:\Users\Admin\AppData\Local\Temp\97b465761dce2027463d0a8e6ff1ce3d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 148
  2⤵
  - Program crash
  PID:2416

memory/2116-0-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download