0ece9dfe590254c16c6a8965a6f0b2b45466ab515aa2c66b795ed32998381f33

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 17:38

Target

d6b9407b18b0ef5cc3cab7831afd088e.exe
Size

83KB
MD5

d6b9407b18b0ef5cc3cab7831afd088e
SHA1

27fa4c839884ee6b009be1b56750d0b1d8ccad70
SHA256

0ece9dfe590254c16c6a8965a6f0b2b45466ab515aa2c66b795ed32998381f33
SHA512

e72e9bc0498f8f2b1500afdf0684daafbb982a5b2528e10206be520bd3c4abfa3e90cdaad2be38a07ade34173cd0d4dea9d4e764ab83553e48072c69d02653c2
SSDEEP

1536:5mN1NXyLwZvnAgt7gzygAK8k3TVtah3fEjg94TVn67hXIQjEErxTWDTMqhGKYIZg:5o3XkwVvwfAdk3THaEjg94RnWjBkMqhW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3048	3032	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 3048	3032	d6b9407b18b0ef5cc3cab7831afd088e.exe	28
PID 3032 wrote to memory of 3048	3032	d6b9407b18b0ef5cc3cab7831afd088e.exe	28
PID 3032 wrote to memory of 3048	3032	d6b9407b18b0ef5cc3cab7831afd088e.exe	28
PID 3032 wrote to memory of 3048	3032	d6b9407b18b0ef5cc3cab7831afd088e.exe	28

C:\Users\Admin\AppData\Local\Temp\d6b9407b18b0ef5cc3cab7831afd088e.exe
"C:\Users\Admin\AppData\Local\Temp\d6b9407b18b0ef5cc3cab7831afd088e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 36
  2⤵
  - Program crash
  PID:3048

memory/3032-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download