458a572ffac28f9a9027d7252c5495f36398086107ff562ea76b30b93e93ee96

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 13:22

Target

7259d8fd8d49c301a00e516a7f3a0e22.exe
Size

192KB
MD5

7259d8fd8d49c301a00e516a7f3a0e22
SHA1

f45eaa39babd9c0e459930f75d036554f3a1d40c
SHA256

458a572ffac28f9a9027d7252c5495f36398086107ff562ea76b30b93e93ee96
SHA512

41aee6ab4f067998072babf4858424a9dd38552283bc00d8c10a4b6b76a6b49f7f8909cb2a0e67f02cb2b30aade409e9685e85c76c59db27412e69bea3acb7e1
SSDEEP

3072:5TeTY1km5WBqwP3fsnQ/Xz7iasXKyC/hX6ixv34Ut7zfwX:5iTtiWB0QL7trJ5Pp34GYX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2300	2052	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2300	2052	7259d8fd8d49c301a00e516a7f3a0e22.exe	28
PID 2052 wrote to memory of 2300	2052	7259d8fd8d49c301a00e516a7f3a0e22.exe	28
PID 2052 wrote to memory of 2300	2052	7259d8fd8d49c301a00e516a7f3a0e22.exe	28
PID 2052 wrote to memory of 2300	2052	7259d8fd8d49c301a00e516a7f3a0e22.exe	28

C:\Users\Admin\AppData\Local\Temp\7259d8fd8d49c301a00e516a7f3a0e22.exe
"C:\Users\Admin\AppData\Local\Temp\7259d8fd8d49c301a00e516a7f3a0e22.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 164
  2⤵
  - Program crash
  PID:2300