57b3823464b1c6c938adb67f8c71c9ab6890e38e94c5a497fb88fd4da72d01c3

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 06:06

Target

0a59c7436663e93f2050dfe23b81926a.exe
Size

207KB
MD5

0a59c7436663e93f2050dfe23b81926a
SHA1

8b15aa50cd5ca62f7c60416ff128129da01a6fad
SHA256

57b3823464b1c6c938adb67f8c71c9ab6890e38e94c5a497fb88fd4da72d01c3
SHA512

451f6667adfc12e8d5caf06d8fe767d223b2a285946eaf5e04913a79512d736c2a2c8fa6db75bb5f77ab2e332341caa196c2405282bbe0a4f11df1b7ee7e3a7f
SSDEEP

6144:teL+Q8WU1WrAZ/bP3RDJZDG1/kb0ZpXJiwirFeScyDKGJfJ+ky:s+tnMAZ73RDzukAZpXvir3KG/+ky

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2040	2112	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2040	2112	0a59c7436663e93f2050dfe23b81926a.exe	28
PID 2112 wrote to memory of 2040	2112	0a59c7436663e93f2050dfe23b81926a.exe	28
PID 2112 wrote to memory of 2040	2112	0a59c7436663e93f2050dfe23b81926a.exe	28
PID 2112 wrote to memory of 2040	2112	0a59c7436663e93f2050dfe23b81926a.exe	28

C:\Users\Admin\AppData\Local\Temp\0a59c7436663e93f2050dfe23b81926a.exe
"C:\Users\Admin\AppData\Local\Temp\0a59c7436663e93f2050dfe23b81926a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 148
  2⤵
  - Program crash
  PID:2040

memory/2112-0-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2112-1-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download