666b1d03b2130f8cee7353c7d5a8647cadee2c544524d161239e31d4208fc5f3

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 18:32

Target

666b1d03b2130f8cee7353c7d5a8647cadee2c544524d161239e31d4208fc5f3.exe
Size

5KB
MD5

1efd368e172f38edc1fd9c855b41cff4
SHA1

f694c03ce88b5e39320f4339373e10048a33efb2
SHA256

666b1d03b2130f8cee7353c7d5a8647cadee2c544524d161239e31d4208fc5f3
SHA512

961995c0b3f5ca8e599faf5f118a62bce69cd8ee861051712726492962b41d521a4b5cd9513c70a3525ad8621077489bb4cd8bc864ebe93d834beb2b7960b72c
SSDEEP

48:SkqlXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7tkRuqSxp:cWLkFfNnOKYloIQ2pm2pbYSQxE

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2932 1032 WerFault.exe 666b1d03b2130f8cee7353c7d5a8647cadee2c544524d161239e31d4208fc5f3.exe

pid	pid_target	process	target process
2932	1032	WerFault.exe	666b1d03b2130f8cee7353c7d5a8647cadee2c544524d161239e31d4208fc5f3.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

666b1d03b2130f8cee7353c7d5a8647cadee2c544524d161239e31d4208fc5f3.exe

description	pid	process	target process
PID 1032 wrote to memory of 2932	1032	666b1d03b2130f8cee7353c7d5a8647cadee2c544524d161239e31d4208fc5f3.exe	WerFault.exe
PID 1032 wrote to memory of 2932	1032	666b1d03b2130f8cee7353c7d5a8647cadee2c544524d161239e31d4208fc5f3.exe	WerFault.exe
PID 1032 wrote to memory of 2932	1032	666b1d03b2130f8cee7353c7d5a8647cadee2c544524d161239e31d4208fc5f3.exe	WerFault.exe
PID 1032 wrote to memory of 2932	1032	666b1d03b2130f8cee7353c7d5a8647cadee2c544524d161239e31d4208fc5f3.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\666b1d03b2130f8cee7353c7d5a8647cadee2c544524d161239e31d4208fc5f3.exe
"C:\Users\Admin\AppData\Local\Temp\666b1d03b2130f8cee7353c7d5a8647cadee2c544524d161239e31d4208fc5f3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 48
2⤵
- Program crash
PID:2932