aa6bed2cc4627fc09e7b77d403e5917a7d7dc84e7c39e47ba5070f1a83b9f593

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21/06/2024, 03:43

Target
8b6f6791b4607f7ace3456828c44e96687e95fbdbd6b827124a26c9f5c8a3d6d.exe
Size 452KB
Sample240621-d94vqa1fnm
SHA256 8b6f6791b4607f7ace3456828c44e96687e95fbdbd6b827124a26c9f5c8a3d6d
MD5 f1b37366c145972849d8a19f96d6eb37
SHA1 6f1796ae181e8fc49d891b821a8eb77ceb660a26
SHA512 d6a4affe01338d56b2e6f24998a079b22ad5fef29b150bad0ac5a348baf74a305b8edd65a33b151828b837775da159a837d654bb4cd11caeedf79118a3a82ae6
SSDEEP 12288:BPQxQCYTZn6Lh6U9Rge4yr/o/Brwu7g1Fkp7tnUv:BPoQJh6Lh66RNbot6yp5Uv
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1676	2264	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 1676	2264	8b6f6791b4607f7ace3456828c44e96687e95fbdbd6b827124a26c9f5c8a3d6d.exe	28
PID 2264 wrote to memory of 1676	2264	8b6f6791b4607f7ace3456828c44e96687e95fbdbd6b827124a26c9f5c8a3d6d.exe	28
PID 2264 wrote to memory of 1676	2264	8b6f6791b4607f7ace3456828c44e96687e95fbdbd6b827124a26c9f5c8a3d6d.exe	28
PID 2264 wrote to memory of 1676	2264	8b6f6791b4607f7ace3456828c44e96687e95fbdbd6b827124a26c9f5c8a3d6d.exe	28

C:\Users\Admin\AppData\Local\Temp\8b6f6791b4607f7ace3456828c44e96687e95fbdbd6b827124a26c9f5c8a3d6d.exe
"C:\Users\Admin\AppData\Local\Temp\8b6f6791b4607f7ace3456828c44e96687e95fbdbd6b827124a26c9f5c8a3d6d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 152
  2⤵
  - Program crash
  PID:1676