6cd98be9660fc1830bf005a84f92fa5e76c44b725f6cddef3e48d2aa1395d4ec

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 22:23

Target

15e6447bff697be5bac0779ef5728230N.exe
Size

320KB
MD5

15e6447bff697be5bac0779ef5728230
SHA1

394e2a54dd74a4a9122c1d31136afae74c3c45b1
SHA256

6cd98be9660fc1830bf005a84f92fa5e76c44b725f6cddef3e48d2aa1395d4ec
SHA512

b845af05d44540c109f6cfb78204e3953994c2ff449a355a72dbcefd4e0703047a91d4a809001d1e3efcabdf8e81951a0940e91074d348816c68855c4ed6554f
SSDEEP

6144:Jdim4xlvQlH2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uT:c412EB0NxDIBuOFe7/uT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2460	1512	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 2460	1512	15e6447bff697be5bac0779ef5728230N.exe	30
PID 1512 wrote to memory of 2460	1512	15e6447bff697be5bac0779ef5728230N.exe	30
PID 1512 wrote to memory of 2460	1512	15e6447bff697be5bac0779ef5728230N.exe	30
PID 1512 wrote to memory of 2460	1512	15e6447bff697be5bac0779ef5728230N.exe	30

C:\Users\Admin\AppData\Local\Temp\15e6447bff697be5bac0779ef5728230N.exe
"C:\Users\Admin\AppData\Local\Temp\15e6447bff697be5bac0779ef5728230N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 36
  2⤵
  - Program crash
  PID:2460

memory/1512-0-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download