6b23536cbc1063ca7a9c58560790717684288b607c31c590c05c777176ed6eb9

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 02:57

Target

aad282c56a11df43f1b09aa8be941403.exe
Size

125KB
MD5

aad282c56a11df43f1b09aa8be941403
SHA1

576bdc0baab04f3eb6a57964285ee581d9c587e4
SHA256

6b23536cbc1063ca7a9c58560790717684288b607c31c590c05c777176ed6eb9
SHA512

ee8df650ca265e45474daa3d71c48205d231cdf2a0c71dd135343aa03e4a3aecffd0b58349af38d6bf7f9564d4ce68aec1a9a605da673e49c1428917ddeba3a6
SSDEEP

1536:0Y7/PJAx+YRYh1K1YOOqOJtH3/J4a57zi0HFN+ZHk+0JipnuGaBNKNYFuoqzEKbH:dJYRYaGb5/Jx/rbl+0YnyCNYFuFzEi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1772	2072	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1772	2072	aad282c56a11df43f1b09aa8be941403.exe	28
PID 2072 wrote to memory of 1772	2072	aad282c56a11df43f1b09aa8be941403.exe	28
PID 2072 wrote to memory of 1772	2072	aad282c56a11df43f1b09aa8be941403.exe	28
PID 2072 wrote to memory of 1772	2072	aad282c56a11df43f1b09aa8be941403.exe	28

C:\Users\Admin\AppData\Local\Temp\aad282c56a11df43f1b09aa8be941403.exe
"C:\Users\Admin\AppData\Local\Temp\aad282c56a11df43f1b09aa8be941403.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 36
  2⤵
  - Program crash
  PID:1772

memory/2072-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2072-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download