56c04529f2a5b5179e51775fd7ded7cf03ac40ca0d9212b48b0822183e3fe866

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 01:12

Target

09b0e23f256555d3de66f299369427d8.exe
Size

127KB
MD5

09b0e23f256555d3de66f299369427d8
SHA1

710048cf50ea9a2894c4bb696c317d005cd81931
SHA256

56c04529f2a5b5179e51775fd7ded7cf03ac40ca0d9212b48b0822183e3fe866
SHA512

205ca32933b4c0acec6340a1d91a2d1bc5a8026e8f63195b25dfb64a94ecbed86270c02c07c83e8144ac01dd687dfdd1080a8e6fd5b8a0900af73136534a9fa9
SSDEEP

3072:FLuJ+Mh1tJNhVwR8J3FdQDzUwLXWXu2gq8Wmg7bAzcuvP4V/bXCIGxAs:4J+QVlwmJPQDzUwLXWXkq8Ww/P6zCIQ1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2508	1732	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2508	1732	09b0e23f256555d3de66f299369427d8.exe	28
PID 1732 wrote to memory of 2508	1732	09b0e23f256555d3de66f299369427d8.exe	28
PID 1732 wrote to memory of 2508	1732	09b0e23f256555d3de66f299369427d8.exe	28
PID 1732 wrote to memory of 2508	1732	09b0e23f256555d3de66f299369427d8.exe	28

C:\Users\Admin\AppData\Local\Temp\09b0e23f256555d3de66f299369427d8.exe
"C:\Users\Admin\AppData\Local\Temp\09b0e23f256555d3de66f299369427d8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 36
  2⤵
  - Program crash
  PID:2508

memory/1732-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1732-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download