6c5b811486bfaa6b7e954a272ccfb5f4e6db723d7283ca00740ce9d94a442f33

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:36

Target

6c5b811486bfaa6b7e954a272ccfb5f4e6db723d7283ca00740ce9d94a442f33.exe
Size

1.4MB
MD5

ae29a7f31e9acca36f6ef4a548a4275b
SHA1

b349b8d7bca7b4f2a913811c1c8fe9944a9b6165
SHA256

6c5b811486bfaa6b7e954a272ccfb5f4e6db723d7283ca00740ce9d94a442f33
SHA512

14848b3764486b5ea581462f104f49d3c1ee031eff2247f8b4667ace3eba2a9048d32396488b57a06710c88eaaff58aa9f222e6a6b615670f1ba9926c8571ed2
SSDEEP

24576:M8PTNYl/q6kmqeiumHOrUFYN30sSYbWhBR1QvhG3:MAKpRxe837WhBRih

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2028 2156 WerFault.exe 6c5b811486bfaa6b7e954a272ccfb5f4e6db723d7283ca00740ce9d94a442f33.exe

pid	pid_target	process	target process
2028	2156	WerFault.exe	6c5b811486bfaa6b7e954a272ccfb5f4e6db723d7283ca00740ce9d94a442f33.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6c5b811486bfaa6b7e954a272ccfb5f4e6db723d7283ca00740ce9d94a442f33.exe

description	pid	process	target process
PID 2156 wrote to memory of 2028	2156	6c5b811486bfaa6b7e954a272ccfb5f4e6db723d7283ca00740ce9d94a442f33.exe	WerFault.exe
PID 2156 wrote to memory of 2028	2156	6c5b811486bfaa6b7e954a272ccfb5f4e6db723d7283ca00740ce9d94a442f33.exe	WerFault.exe
PID 2156 wrote to memory of 2028	2156	6c5b811486bfaa6b7e954a272ccfb5f4e6db723d7283ca00740ce9d94a442f33.exe	WerFault.exe
PID 2156 wrote to memory of 2028	2156	6c5b811486bfaa6b7e954a272ccfb5f4e6db723d7283ca00740ce9d94a442f33.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\6c5b811486bfaa6b7e954a272ccfb5f4e6db723d7283ca00740ce9d94a442f33.exe
"C:\Users\Admin\AppData\Local\Temp\6c5b811486bfaa6b7e954a272ccfb5f4e6db723d7283ca00740ce9d94a442f33.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 36
2⤵
- Program crash
PID:2028