2f199762757e1651004a61dc46d68947d45669917715f2993ba825f0f13cda65

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-03-2024 08:43

Target

b6ffecfbe0784af3193af26334b9e728.exe
Size

41KB
MD5

b6ffecfbe0784af3193af26334b9e728
SHA1

11aa00255dabd7c8a73b666f16342d0bb6b60284
SHA256

2f199762757e1651004a61dc46d68947d45669917715f2993ba825f0f13cda65
SHA512

af74fa44b3da58426e0d8e345719940fe9b6b8ccdcec67542abcb43de0fdfee77935514ac98c5941e937097dcafdb95f8b7b24fa52f790ba6dcaf7c25518cc9b
SSDEEP

768:8vvKhHGwo3As47TEIcv1byj+GzofKj4LwiDGC3KZ95HdoRbb7ud9:LhHZows47TEVtbe+lLnDXat9oQd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2204	2332	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2204	2332	b6ffecfbe0784af3193af26334b9e728.exe	28
PID 2332 wrote to memory of 2204	2332	b6ffecfbe0784af3193af26334b9e728.exe	28
PID 2332 wrote to memory of 2204	2332	b6ffecfbe0784af3193af26334b9e728.exe	28
PID 2332 wrote to memory of 2204	2332	b6ffecfbe0784af3193af26334b9e728.exe	28

C:\Users\Admin\AppData\Local\Temp\b6ffecfbe0784af3193af26334b9e728.exe
"C:\Users\Admin\AppData\Local\Temp\b6ffecfbe0784af3193af26334b9e728.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 148
  2⤵
  - Program crash
  PID:2204

memory/2332-0-0x0000000013140000-0x0000000013179000-memory.dmp

Filesize
228KB

Download