6ec629dc51966d16cb931e52d32c68c2acc0e365de7dd06f50fea8c38738bfdb

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 04:07

Target

e864d6a669fa9d7c8a397e1ef5ba8120.exe
Size

115KB
MD5

e864d6a669fa9d7c8a397e1ef5ba8120
SHA1

efdda539d04db32763840fc836ec8816882c196b
SHA256

6ec629dc51966d16cb931e52d32c68c2acc0e365de7dd06f50fea8c38738bfdb
SHA512

e597ad030c95aa52d6e3864ad94f5412103c22e3846fddd034040357bf6dab7acc0a4cb097130b79224f77180ef04b7643c371ac292ec4cabe78d7e8a6b108a1
SSDEEP

1536:5DvcP3LThpshwVs5OE8yNcYQp+2ZZICS4AnjnBR561lQVMr3IgmffEbjQFOx:k4SVhaNcYM81nBR5uiV1UvQFOx

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2160 2128 WerFault.exe e864d6a669fa9d7c8a397e1ef5ba8120.exe

pid	pid_target	process	target process
2160	2128	WerFault.exe	e864d6a669fa9d7c8a397e1ef5ba8120.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e864d6a669fa9d7c8a397e1ef5ba8120.exe

description	pid	process	target process
PID 2128 wrote to memory of 2160	2128	e864d6a669fa9d7c8a397e1ef5ba8120.exe	WerFault.exe
PID 2128 wrote to memory of 2160	2128	e864d6a669fa9d7c8a397e1ef5ba8120.exe	WerFault.exe
PID 2128 wrote to memory of 2160	2128	e864d6a669fa9d7c8a397e1ef5ba8120.exe	WerFault.exe
PID 2128 wrote to memory of 2160	2128	e864d6a669fa9d7c8a397e1ef5ba8120.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e864d6a669fa9d7c8a397e1ef5ba8120.exe
"C:\Users\Admin\AppData\Local\Temp\e864d6a669fa9d7c8a397e1ef5ba8120.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 36
  2⤵
  - Program crash
  PID:2160