6a9eae257feaccc6974fecd3c2bbf37f6e6a5d5333eb374f746b7ee54d140df0

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-03-2024 17:50

Target

b800e6f97c6af089864d7c6a7ca756f9.exe
Size

344KB
MD5

b800e6f97c6af089864d7c6a7ca756f9
SHA1

5c8befed4e98fc3df783b4a1bb945bc6c8ccd3b3
SHA256

6a9eae257feaccc6974fecd3c2bbf37f6e6a5d5333eb374f746b7ee54d140df0
SHA512

8c697d9c2f80e6a2e0877245937157e346c01d2167cad2993e44813d2719e3bb57a3eede2ea27cd403ce32b55f3209dfe3ad4b0581ee385c05ca062c073455c3
SSDEEP

6144:qfUOzheBF2idZecnl20lHRxp3grqDyNv05T4N6+Or3Iba0h6uIMWOEzy0T4tKPpS:qfRzhAF3Z4mxx+qDy50oEr/0h6z3TThk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1508	2188	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 1508	2188	b800e6f97c6af089864d7c6a7ca756f9.exe	28
PID 2188 wrote to memory of 1508	2188	b800e6f97c6af089864d7c6a7ca756f9.exe	28
PID 2188 wrote to memory of 1508	2188	b800e6f97c6af089864d7c6a7ca756f9.exe	28
PID 2188 wrote to memory of 1508	2188	b800e6f97c6af089864d7c6a7ca756f9.exe	28

C:\Users\Admin\AppData\Local\Temp\b800e6f97c6af089864d7c6a7ca756f9.exe
"C:\Users\Admin\AppData\Local\Temp\b800e6f97c6af089864d7c6a7ca756f9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 140
  2⤵
  - Program crash
  PID:1508

memory/2188-0-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download