85bd5d62c3f0205d57906f65f8384379a41b5cb27dcafdb369a19dacb875204f

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 16:06

Target

7b59e1a6f499159e22f52b6a11e38654.exe
Size

367KB
MD5

7b59e1a6f499159e22f52b6a11e38654
SHA1

7eefa47e3e99ab31afdfa4745cf575780ca1d4fb
SHA256

85bd5d62c3f0205d57906f65f8384379a41b5cb27dcafdb369a19dacb875204f
SHA512

061372ed9c69876b0000421af2c94a709e2803d974ce40a7bd328ff25906154854c590b1ac32c2adc43219b0f299c730a1b2bec628ffcd6b9f294e271b2bdaf8
SSDEEP

6144:rpEcAd/Mm5ZkyUneRTnJOmQ4W4/6zA5K0TzJRCp4xRvKUllD/W13+y:rTAOm5eyUnJmCzAXTzJR3RvK6lCwy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2004	1680	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2004	1680	7b59e1a6f499159e22f52b6a11e38654.exe	28
PID 1680 wrote to memory of 2004	1680	7b59e1a6f499159e22f52b6a11e38654.exe	28
PID 1680 wrote to memory of 2004	1680	7b59e1a6f499159e22f52b6a11e38654.exe	28
PID 1680 wrote to memory of 2004	1680	7b59e1a6f499159e22f52b6a11e38654.exe	28

C:\Users\Admin\AppData\Local\Temp\7b59e1a6f499159e22f52b6a11e38654.exe
"C:\Users\Admin\AppData\Local\Temp\7b59e1a6f499159e22f52b6a11e38654.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 116
  2⤵
  - Program crash
  PID:2004

memory/1680-0-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Filesize
384KB

Download