6f8be3c8110ca47ad433db1577f991f833bdf96228d23a8391b41b3ba6d1458c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 17:38

Target

6f8be3c8110ca47ad433db1577f991f833bdf96228d23a8391b41b3ba6d1458c.exe
Size

368KB
MD5

b3546f7a820791147e38a8e29ebd6a68
SHA1

5957bde110841e731ad81d1e8899180f459af8a8
SHA256

6f8be3c8110ca47ad433db1577f991f833bdf96228d23a8391b41b3ba6d1458c
SHA512

18723b1b86d87fb23fce8a9fbe196d18072c423215e5f8702171f99c41875ad676d73982f7a68e11f06b563da8d012133e9d32b18a8b17d5b62475b5ab28a354
SSDEEP

6144:W4+YAzt60iv4OY6V96+muFr2ejshqo/RQ8HB539j6lHYVfP6yA0pD/a7a2fhDV9D:W4+YAztviv4OY6V96+mu5jshqo/RQ8hK

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2024 1664 WerFault.exe 6f8be3c8110ca47ad433db1577f991f833bdf96228d23a8391b41b3ba6d1458c.exe

pid	pid_target	process	target process
2024	1664	WerFault.exe	6f8be3c8110ca47ad433db1577f991f833bdf96228d23a8391b41b3ba6d1458c.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6f8be3c8110ca47ad433db1577f991f833bdf96228d23a8391b41b3ba6d1458c.exe

description	pid	process	target process
PID 1664 wrote to memory of 2024	1664	6f8be3c8110ca47ad433db1577f991f833bdf96228d23a8391b41b3ba6d1458c.exe	WerFault.exe
PID 1664 wrote to memory of 2024	1664	6f8be3c8110ca47ad433db1577f991f833bdf96228d23a8391b41b3ba6d1458c.exe	WerFault.exe
PID 1664 wrote to memory of 2024	1664	6f8be3c8110ca47ad433db1577f991f833bdf96228d23a8391b41b3ba6d1458c.exe	WerFault.exe
PID 1664 wrote to memory of 2024	1664	6f8be3c8110ca47ad433db1577f991f833bdf96228d23a8391b41b3ba6d1458c.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\6f8be3c8110ca47ad433db1577f991f833bdf96228d23a8391b41b3ba6d1458c.exe
"C:\Users\Admin\AppData\Local\Temp\6f8be3c8110ca47ad433db1577f991f833bdf96228d23a8391b41b3ba6d1458c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 120
2⤵
- Program crash
PID:2024