1691b1ffa5c27ee1273bbc3a6768026e8fcb815d3dd3b11c99de8e915df7bffb

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 14:42

Target

1691b1ffa5c27ee1273bbc3a6768026e8fcb815d3dd3b11c99de8e915df7bffb.exe
Size

467KB
MD5

994820e52e73ea1e5f466a9d647ff727
SHA1

0c26942023222df2d415c32ffa7d3c4f4f761035
SHA256

1691b1ffa5c27ee1273bbc3a6768026e8fcb815d3dd3b11c99de8e915df7bffb
SHA512

8cb65d0e34b45ab8c5d22fa061594ef2c404bb9e2df6dd8d8fec61518f191b5bcf5bcf07d4d6912d52e464d2f417f0e2b11f415c48b295196688c8608965ec1d
SSDEEP

6144:T3PjMAbo8tdR6tivMh2WL+k3EbfJpmvhuFlLeuhtHSkJgiwJH7uHFmm9iXjq0GQ2:TIYo8tdR60GAJpUuFpV/yVNH7AqXjp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1692	2168	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 1692	2168	1691b1ffa5c27ee1273bbc3a6768026e8fcb815d3dd3b11c99de8e915df7bffb.exe	28
PID 2168 wrote to memory of 1692	2168	1691b1ffa5c27ee1273bbc3a6768026e8fcb815d3dd3b11c99de8e915df7bffb.exe	28
PID 2168 wrote to memory of 1692	2168	1691b1ffa5c27ee1273bbc3a6768026e8fcb815d3dd3b11c99de8e915df7bffb.exe	28
PID 2168 wrote to memory of 1692	2168	1691b1ffa5c27ee1273bbc3a6768026e8fcb815d3dd3b11c99de8e915df7bffb.exe	28

C:\Users\Admin\AppData\Local\Temp\1691b1ffa5c27ee1273bbc3a6768026e8fcb815d3dd3b11c99de8e915df7bffb.exe
"C:\Users\Admin\AppData\Local\Temp\1691b1ffa5c27ee1273bbc3a6768026e8fcb815d3dd3b11c99de8e915df7bffb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 148
  2⤵
  - Program crash
  PID:1692

memory/2168-0-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2168-1-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download