6b0eab73dac986e9fe67df99a1436b7ca90324353172541077bea5ba35dcfb38

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 10:40

Target

cb31f4e64bf64b7fa901c1f77d763d06.exe
Size

884KB
MD5

cb31f4e64bf64b7fa901c1f77d763d06
SHA1

3361109d435d6eef48c83deab8f3e2a2855c7966
SHA256

6b0eab73dac986e9fe67df99a1436b7ca90324353172541077bea5ba35dcfb38
SHA512

b855a7eb7800283786baf9d66d5f7c43c08562f5c65721f476f15d1b8c0fbce29f12bbd4c28d14d96db1c3ce665b325dfb1a6666b711eccca0de8c30be4bbfa1
SSDEEP

6144:nTeqswF/fzVNmueXiecdYAlTHrkJns5gLHEJtyL3zS+8X9Rec5E4dQ8xB3sr3vuY:nTeqZxNmsDes5g7EJQDuL9Rk8xBMvuY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2940	2080	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2940	2080	cb31f4e64bf64b7fa901c1f77d763d06.exe	28
PID 2080 wrote to memory of 2940	2080	cb31f4e64bf64b7fa901c1f77d763d06.exe	28
PID 2080 wrote to memory of 2940	2080	cb31f4e64bf64b7fa901c1f77d763d06.exe	28
PID 2080 wrote to memory of 2940	2080	cb31f4e64bf64b7fa901c1f77d763d06.exe	28

C:\Users\Admin\AppData\Local\Temp\cb31f4e64bf64b7fa901c1f77d763d06.exe
"C:\Users\Admin\AppData\Local\Temp\cb31f4e64bf64b7fa901c1f77d763d06.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 148
  2⤵
  - Program crash
  PID:2940