12d870659550943fc27007dd889e8657fb5fbdab31fd89ab013d0855f3375897

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 22:59

Target

59a1c0583b92f0f1121e730e52d65a0f.exe
Size

116KB
MD5

59a1c0583b92f0f1121e730e52d65a0f
SHA1

80ea982708963dfe5c2e062a965f5353f753a70a
SHA256

12d870659550943fc27007dd889e8657fb5fbdab31fd89ab013d0855f3375897
SHA512

febfb2a81daaf2eba45660aaa375cc94c21703c546e1e0de35f659a11d8df6ad7d12a5fbc56e1eecb1c880dba8add3444a9bc39fb27077beb438350540293f8b
SSDEEP

3072:xppFr4lZAj+5UOQacSJAvMvm1vEYfTbZo0D0HzrG59joZAjp:Xjr4YjyUOdJAccEATbZt04Fjp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1880	624	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 1880	624	59a1c0583b92f0f1121e730e52d65a0f.exe	28
PID 624 wrote to memory of 1880	624	59a1c0583b92f0f1121e730e52d65a0f.exe	28
PID 624 wrote to memory of 1880	624	59a1c0583b92f0f1121e730e52d65a0f.exe	28
PID 624 wrote to memory of 1880	624	59a1c0583b92f0f1121e730e52d65a0f.exe	28

C:\Users\Admin\AppData\Local\Temp\59a1c0583b92f0f1121e730e52d65a0f.exe
"C:\Users\Admin\AppData\Local\Temp\59a1c0583b92f0f1121e730e52d65a0f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 36
  2⤵
  - Program crash
  PID:1880

memory/624-0-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/624-1-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download