8e6e43df08951916adca26672320ee3100c0605b9355eb74bf529c66546ffbb5

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-04-2024 00:34

Target

a6c151ab4a6fc059dea03d13e02784b6.exe
Size

44KB
MD5

a6c151ab4a6fc059dea03d13e02784b6
SHA1

30e76ad7da3c50d7c2d9e69885bb9668fa7a4b32
SHA256

8e6e43df08951916adca26672320ee3100c0605b9355eb74bf529c66546ffbb5
SHA512

70e33ed4fd26b67742783a36078af5b39052f71ea343ba17b9cd8345363ec7c489baae389a193c261f7f21b23ccf4dfb91c1b7601dad610c9b7823d8579b5ca5
SSDEEP

768:hY+OvuxErRsPc6SzNSwddLLAlzLQbUU8/E0l4ql/649+wREkUnZoWOFVc8D:hYnvuurCPczNSQAlzUwmCBpREk3Vl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1628	3000	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 1628	3000	a6c151ab4a6fc059dea03d13e02784b6.exe	28
PID 3000 wrote to memory of 1628	3000	a6c151ab4a6fc059dea03d13e02784b6.exe	28
PID 3000 wrote to memory of 1628	3000	a6c151ab4a6fc059dea03d13e02784b6.exe	28
PID 3000 wrote to memory of 1628	3000	a6c151ab4a6fc059dea03d13e02784b6.exe	28

C:\Users\Admin\AppData\Local\Temp\a6c151ab4a6fc059dea03d13e02784b6.exe
"C:\Users\Admin\AppData\Local\Temp\a6c151ab4a6fc059dea03d13e02784b6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 36
  2⤵
  - Program crash
  PID:1628

memory/3000-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download