268d5330ebeb83ec25226c86586a43274746ddd60e69511701caa62dca6a56fa

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 17:19

Target

59465f7d60d70263676c5658bdf81b96.exe
Size

65KB
MD5

59465f7d60d70263676c5658bdf81b96
SHA1

cfb54d80b230a65535937b7e1f897e74bd8a30f1
SHA256

268d5330ebeb83ec25226c86586a43274746ddd60e69511701caa62dca6a56fa
SHA512

4585afa36d8fb6f5c3b9ff0e37d08de2c51830ad25fff893c6f80d31538161a1f4b8439bb8cb33a8560297a532ac00a70192aa1f26c0709f52663bc040452e5f
SSDEEP

768:EJCJE9CUabnY3ksLD0w+Tm1ePIrtV3reFHtFRi2oZMq0GkwXd/5LzJZOzToEoM0S:EnCUaE9RSHVgMqe2z5G1ocJMbY7hv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1540	1732	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1540	1732	59465f7d60d70263676c5658bdf81b96.exe	28
PID 1732 wrote to memory of 1540	1732	59465f7d60d70263676c5658bdf81b96.exe	28
PID 1732 wrote to memory of 1540	1732	59465f7d60d70263676c5658bdf81b96.exe	28
PID 1732 wrote to memory of 1540	1732	59465f7d60d70263676c5658bdf81b96.exe	28

C:\Users\Admin\AppData\Local\Temp\59465f7d60d70263676c5658bdf81b96.exe
"C:\Users\Admin\AppData\Local\Temp\59465f7d60d70263676c5658bdf81b96.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 148
  2⤵
  - Program crash
  PID:1540

memory/1732-0-0x0000000000400000-0x0000000000408640-memory.dmp

Filesize
33KB

Download