e660be79de0932d6c5c0f1b65dc5d842ed790962625d5dd8731c30f46ae264a2

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 10:53

Target

a6207c613c2f1beb9db6fd16ae372212cbd82f73a8c94afafe4c867a27518304.exe
Size

273KB
MD5

a972f14351dbfb8cf0f4f36b815c340f
SHA1

693b785f30834b9ee17875c415e5f5a9187eac7b
SHA256

a6207c613c2f1beb9db6fd16ae372212cbd82f73a8c94afafe4c867a27518304
SHA512

57a3a8dd035e27db6681ab60e07c374e6967c2ba3baccf1c5b495f24824a65ede370d3299337c51bb6837b73938d626d95d33ae91827d79475425583869cbf1e
SSDEEP

6144:DqePsi5kV1JFy070vzu3PQ5AGVpyWKe9a6n:2ePs6xru3KAs15Fn

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2892 2276 WerFault.exe a6207c613c2f1beb9db6fd16ae372212cbd82f73a8c94afafe4c867a27518304.exe

pid	pid_target	process	target process
2892	2276	WerFault.exe	a6207c613c2f1beb9db6fd16ae372212cbd82f73a8c94afafe4c867a27518304.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a6207c613c2f1beb9db6fd16ae372212cbd82f73a8c94afafe4c867a27518304.exe

description	pid	process	target process
PID 2276 wrote to memory of 2892	2276	a6207c613c2f1beb9db6fd16ae372212cbd82f73a8c94afafe4c867a27518304.exe	WerFault.exe
PID 2276 wrote to memory of 2892	2276	a6207c613c2f1beb9db6fd16ae372212cbd82f73a8c94afafe4c867a27518304.exe	WerFault.exe
PID 2276 wrote to memory of 2892	2276	a6207c613c2f1beb9db6fd16ae372212cbd82f73a8c94afafe4c867a27518304.exe	WerFault.exe
PID 2276 wrote to memory of 2892	2276	a6207c613c2f1beb9db6fd16ae372212cbd82f73a8c94afafe4c867a27518304.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a6207c613c2f1beb9db6fd16ae372212cbd82f73a8c94afafe4c867a27518304.exe
"C:\Users\Admin\AppData\Local\Temp\a6207c613c2f1beb9db6fd16ae372212cbd82f73a8c94afafe4c867a27518304.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 72
  2⤵
  - Program crash
  PID:2892

memory/2276-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2276-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download