6dbb29ef928f8ca3ad5d4fe2e1ad07f70baddad8b043018fb5f5467e06c992f7

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 16:17

Target

6dbb29ef928f8ca3ad5d4fe2e1ad07f70baddad8b043018fb5f5467e06c992f7.exe
Size

528KB
MD5

0d412cad6191d60273de2821755740c5
SHA1

038e614a4888ad8dab65d64b7498614252ea8ee9
SHA256

6dbb29ef928f8ca3ad5d4fe2e1ad07f70baddad8b043018fb5f5467e06c992f7
SHA512

61e3ca6b7b0858e520641e6cb1dfcb36b675606ec40e89cab820e993d7f25f3b1665ce8b2aab5e5a0cd606c497f1f7e18f5b432b4059a69e87ffda7cb85b4ceb
SSDEEP

12288:OD3Qe+Tyrf6h6P3NHuJ6riSxTLV8Q/xY5sGXcEO:OkefzgmuJciYh8QYst

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2372	1876	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2372	1876	6dbb29ef928f8ca3ad5d4fe2e1ad07f70baddad8b043018fb5f5467e06c992f7.exe	28
PID 1876 wrote to memory of 2372	1876	6dbb29ef928f8ca3ad5d4fe2e1ad07f70baddad8b043018fb5f5467e06c992f7.exe	28
PID 1876 wrote to memory of 2372	1876	6dbb29ef928f8ca3ad5d4fe2e1ad07f70baddad8b043018fb5f5467e06c992f7.exe	28
PID 1876 wrote to memory of 2372	1876	6dbb29ef928f8ca3ad5d4fe2e1ad07f70baddad8b043018fb5f5467e06c992f7.exe	28

C:\Users\Admin\AppData\Local\Temp\6dbb29ef928f8ca3ad5d4fe2e1ad07f70baddad8b043018fb5f5467e06c992f7.exe
"C:\Users\Admin\AppData\Local\Temp\6dbb29ef928f8ca3ad5d4fe2e1ad07f70baddad8b043018fb5f5467e06c992f7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 64
  2⤵
  - Program crash
  PID:2372

memory/1876-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download