2d6baf640bbfb9bdea9086cb6b21c58d4bd6a434fe85c60a4b86c46301d4c156

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 20:02

Target

2d6baf640bbfb9bdea9086cb6b21c58d4bd6a434fe85c60a4b86c46301d4c156.exe
Size

5KB
MD5

c813e0ec9a4d3bcf0092a4257de22c7d
SHA1

b9a17469e01bd97802a092f303543137380f19a6
SHA256

2d6baf640bbfb9bdea9086cb6b21c58d4bd6a434fe85c60a4b86c46301d4c156
SHA512

bc635a7d1d97f335f72b23e980cb8ae1c36a5234470f559a4c095d24f509797bde50e5380cd794359e1d2e83330fcbba3cbbbf4186f49bf9664b717422120d26
SSDEEP

48:SDlXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7t2RuqSxp:4WLkFfNnOKYloIQ2pm2pbYSixE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2884	2868	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2884	2868	2d6baf640bbfb9bdea9086cb6b21c58d4bd6a434fe85c60a4b86c46301d4c156.exe	28
PID 2868 wrote to memory of 2884	2868	2d6baf640bbfb9bdea9086cb6b21c58d4bd6a434fe85c60a4b86c46301d4c156.exe	28
PID 2868 wrote to memory of 2884	2868	2d6baf640bbfb9bdea9086cb6b21c58d4bd6a434fe85c60a4b86c46301d4c156.exe	28
PID 2868 wrote to memory of 2884	2868	2d6baf640bbfb9bdea9086cb6b21c58d4bd6a434fe85c60a4b86c46301d4c156.exe	28

C:\Users\Admin\AppData\Local\Temp\2d6baf640bbfb9bdea9086cb6b21c58d4bd6a434fe85c60a4b86c46301d4c156.exe
"C:\Users\Admin\AppData\Local\Temp\2d6baf640bbfb9bdea9086cb6b21c58d4bd6a434fe85c60a4b86c46301d4c156.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 48
  2⤵
  - Program crash
  PID:2884