d06d804ed592436dea486beb37ad20ec83ba44ff71a3524af72b61ccd7affce7

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-01-2024 16:01

Target

56e4c467f5c0fd924bd6d59fa3ba0895.exe
Size

49KB
MD5

56e4c467f5c0fd924bd6d59fa3ba0895
SHA1

181430094ab36885611ce648d306064a2fba5131
SHA256

d06d804ed592436dea486beb37ad20ec83ba44ff71a3524af72b61ccd7affce7
SHA512

c0df553f05a93b89f2d22b387911f11379c422e8efd8800709a9044574fc337223d6b5007d212c4e3c527fbe7075f0aa9d1a0e02d9939a75bfb2dd6fb1bf4d15
SSDEEP

768:26DW8cxflagfBG5omPIzVFtFnyZ+y+wt2vYOKvB8v:LyjBfBoPIz7t4ZV+wt2hKvuv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1752	2252	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 1752	2252	56e4c467f5c0fd924bd6d59fa3ba0895.exe	28
PID 2252 wrote to memory of 1752	2252	56e4c467f5c0fd924bd6d59fa3ba0895.exe	28
PID 2252 wrote to memory of 1752	2252	56e4c467f5c0fd924bd6d59fa3ba0895.exe	28
PID 2252 wrote to memory of 1752	2252	56e4c467f5c0fd924bd6d59fa3ba0895.exe	28

C:\Users\Admin\AppData\Local\Temp\56e4c467f5c0fd924bd6d59fa3ba0895.exe
"C:\Users\Admin\AppData\Local\Temp\56e4c467f5c0fd924bd6d59fa3ba0895.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 136
  2⤵
  - Program crash
  PID:1752