9fb87f7f5f15f6706b0b832d6382a43c6cf325b857af0332f5ec9f1988fc233a

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/02/2023, 19:29

Target

59ccd7290e2a5469f09d3c95ad63875750410a69.exe
Size

37KB
MD5

745cd1c0d634761f772399394dea5592
SHA1

59ccd7290e2a5469f09d3c95ad63875750410a69
SHA256

9fb87f7f5f15f6706b0b832d6382a43c6cf325b857af0332f5ec9f1988fc233a
SHA512

d594c36181acc886ee4c03eb1753860be2f4b5c03f5ba4269336f2e4677a673a00e3699dee02df0fce02d1236dc964766cd8848eddff72abaeb6637dc9cf6429
SSDEEP

768:eevuNS3G1TxGG+tNOIXVYxWgr/wt+lwqt5RYVMAz24v:wNS21T4G+tNBXViDQ+CqtfY8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2000	1356	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 2000	1356	59ccd7290e2a5469f09d3c95ad63875750410a69.exe	28
PID 1356 wrote to memory of 2000	1356	59ccd7290e2a5469f09d3c95ad63875750410a69.exe	28
PID 1356 wrote to memory of 2000	1356	59ccd7290e2a5469f09d3c95ad63875750410a69.exe	28

C:\Users\Admin\AppData\Local\Temp\59ccd7290e2a5469f09d3c95ad63875750410a69.exe
"C:\Users\Admin\AppData\Local\Temp\59ccd7290e2a5469f09d3c95ad63875750410a69.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1356 -s 724
  2⤵
  - Program crash
  PID:2000

memory/1356-54-0x0000000000360000-0x000000000036E000-memory.dmp

Filesize
56KB

Download
memory/1356-55-0x000007FEFBF21000-0x000007FEFBF23000-memory.dmp

Filesize
8KB

Download