e482fdcdaffe073fe51647e2efa6c07ca5340c7c0b2bc60a77d979243a0d0106

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 06:28

Target

59997d5777583214d5b27f84cb696afd.exe
Size

60KB
MD5

59997d5777583214d5b27f84cb696afd
SHA1

edbc8fac5cc47ca9552109bb4d953fa73f797028
SHA256

e482fdcdaffe073fe51647e2efa6c07ca5340c7c0b2bc60a77d979243a0d0106
SHA512

78d7dc16c0b155fedaec468892fd84daef7049cc0d33c5397a568628a40184398934ab07b42a24d2e263e5f5115253864ae8534012f2b4d1dcd0f489ac8a169e
SSDEEP

768:GyxGlgPO2K080wgqAojtP0kwEYw9zWudzJZ+/yuA2tFGv0:QliORDwEYmz7Nfvu/tov0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2672	2220	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2672	2220	59997d5777583214d5b27f84cb696afd.exe	28
PID 2220 wrote to memory of 2672	2220	59997d5777583214d5b27f84cb696afd.exe	28
PID 2220 wrote to memory of 2672	2220	59997d5777583214d5b27f84cb696afd.exe	28
PID 2220 wrote to memory of 2672	2220	59997d5777583214d5b27f84cb696afd.exe	28

C:\Users\Admin\AppData\Local\Temp\59997d5777583214d5b27f84cb696afd.exe
"C:\Users\Admin\AppData\Local\Temp\59997d5777583214d5b27f84cb696afd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 116
  2⤵
  - Program crash
  PID:2672