9fb87f7f5f15f6706b0b832d6382a43c6cf325b857af0332f5ec9f1988fc233a

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-02-2023 18:59

Target

59ccd7290e2a5469f09d3c95ad63875750410a69.exe
Size

37KB
MD5

745cd1c0d634761f772399394dea5592
SHA1

59ccd7290e2a5469f09d3c95ad63875750410a69
SHA256

9fb87f7f5f15f6706b0b832d6382a43c6cf325b857af0332f5ec9f1988fc233a
SHA512

d594c36181acc886ee4c03eb1753860be2f4b5c03f5ba4269336f2e4677a673a00e3699dee02df0fce02d1236dc964766cd8848eddff72abaeb6637dc9cf6429
SSDEEP

768:eevuNS3G1TxGG+tNOIXVYxWgr/wt+lwqt5RYVMAz24v:wNS21T4G+tNBXViDQ+CqtfY8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
960	1844	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 960	1844	59ccd7290e2a5469f09d3c95ad63875750410a69.exe	27
PID 1844 wrote to memory of 960	1844	59ccd7290e2a5469f09d3c95ad63875750410a69.exe	27
PID 1844 wrote to memory of 960	1844	59ccd7290e2a5469f09d3c95ad63875750410a69.exe	27

C:\Users\Admin\AppData\Local\Temp\59ccd7290e2a5469f09d3c95ad63875750410a69.exe
"C:\Users\Admin\AppData\Local\Temp\59ccd7290e2a5469f09d3c95ad63875750410a69.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1844 -s 728
  2⤵
  - Program crash
  PID:960

memory/960-56-0x0000000000000000-mapping.dmp

Download
memory/1844-54-0x00000000009C0000-0x00000000009CE000-memory.dmp

Filesize
56KB

Download
memory/1844-55-0x000007FEFBF71000-0x000007FEFBF73000-memory.dmp

Filesize
8KB

Download