1578c93d25e24eb65d4bc2dbd6755aecd8030378f7188c37eb48e8a417b6234f

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-01-2024 08:11

Target

586c8c2737bcef3dd00d59de867d657d.exe
Size

477KB
MD5

586c8c2737bcef3dd00d59de867d657d
SHA1

8d036588b457c1b4ef8ae6285e7f50b1223cf07a
SHA256

1578c93d25e24eb65d4bc2dbd6755aecd8030378f7188c37eb48e8a417b6234f
SHA512

9e93d0a02646065b253103c15014884094718605f9cebb412283bd81df578f712e6e843f874cbbf67c6327294275575c9fa96869a14535c96b820a6948272f9f
SSDEEP

6144:/+ypfcZxVanYLd0VvenBzQmKdztKRE5HsUtApvmIPb/h2mHSWvN/T/XrSu6wU:2ypfcZxsnYLd7QNvxLIP5yeRT2uVU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2980	2912	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2980	2912	586c8c2737bcef3dd00d59de867d657d.exe	28
PID 2912 wrote to memory of 2980	2912	586c8c2737bcef3dd00d59de867d657d.exe	28
PID 2912 wrote to memory of 2980	2912	586c8c2737bcef3dd00d59de867d657d.exe	28
PID 2912 wrote to memory of 2980	2912	586c8c2737bcef3dd00d59de867d657d.exe	28

C:\Users\Admin\AppData\Local\Temp\586c8c2737bcef3dd00d59de867d657d.exe
"C:\Users\Admin\AppData\Local\Temp\586c8c2737bcef3dd00d59de867d657d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 200
  2⤵
  - Program crash
  PID:2980

memory/2912-0-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download