66efa6f2e7b071b20e490b40b5f502021d54f3352b2a716b9da0cb2c241ac141

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-03-2024 06:45

Target

b6c4feab95e1d105f1aeb1675e55de2b.exe
Size

32KB
MD5

b6c4feab95e1d105f1aeb1675e55de2b
SHA1

9819dce1fbc3efe9827226d794e838aba88ac2ab
SHA256

66efa6f2e7b071b20e490b40b5f502021d54f3352b2a716b9da0cb2c241ac141
SHA512

1b9f732c173976341267ba294161d76ff6a91b2000dfa989f8fcc562e66acfdbd044e927db7d8c81b02b4448320337211085b0b0023bcb9d6750430ea2280f0d
SSDEEP

768:2gZqslN/e81eMvKouRwiyNS0SRsvoHvtloL2ElQhcBZz7hv6PlTx:26qsl71tvfRN7SOKly2ElQm9hv69x

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2832	2660	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2832	2660	b6c4feab95e1d105f1aeb1675e55de2b.exe	28
PID 2660 wrote to memory of 2832	2660	b6c4feab95e1d105f1aeb1675e55de2b.exe	28
PID 2660 wrote to memory of 2832	2660	b6c4feab95e1d105f1aeb1675e55de2b.exe	28
PID 2660 wrote to memory of 2832	2660	b6c4feab95e1d105f1aeb1675e55de2b.exe	28

C:\Users\Admin\AppData\Local\Temp\b6c4feab95e1d105f1aeb1675e55de2b.exe
"C:\Users\Admin\AppData\Local\Temp\b6c4feab95e1d105f1aeb1675e55de2b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 88
  2⤵
  - Program crash
  PID:2832

memory/2660-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download