bf6fd9d0bfdb93c1ff80655319bfd5c86e6d08e2b94238a6ce06c1c2c8cc1303

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 22:27

Target

059885497c3988498aeac3fc712d27de.exe
Size

20KB
MD5

059885497c3988498aeac3fc712d27de
SHA1

0999acd776063af3ad4cbc06f8330225f32ba508
SHA256

bf6fd9d0bfdb93c1ff80655319bfd5c86e6d08e2b94238a6ce06c1c2c8cc1303
SHA512

304803864f47c9b62ecd428f29463c91b86723fd43bc4dccace2cda589b22a180a3c4ddf2bf9c981aa57b5bcbb004dab203a1178cc7c2c61f02f9b3f442857c8
SSDEEP

192:E4HwXHhZ+5lEfns6uGMWc72JugoJeA2VgEd0VgeBNyL65Usmk4/srviTWU:EAwXHhb/s61MWc7SvA2qoMgi5r4ELi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2772	2932	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2772	2932	059885497c3988498aeac3fc712d27de.exe	28
PID 2932 wrote to memory of 2772	2932	059885497c3988498aeac3fc712d27de.exe	28
PID 2932 wrote to memory of 2772	2932	059885497c3988498aeac3fc712d27de.exe	28
PID 2932 wrote to memory of 2772	2932	059885497c3988498aeac3fc712d27de.exe	28

C:\Users\Admin\AppData\Local\Temp\059885497c3988498aeac3fc712d27de.exe
"C:\Users\Admin\AppData\Local\Temp\059885497c3988498aeac3fc712d27de.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 88
  2⤵
  - Program crash
  PID:2772

memory/2932-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download