e78bc392a0ab09d81926e935020b05f759aa42859524084c26f36718db6a60b6

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 10:15

Target

c59cdbed359e346d47997d9641ee83db.exe
Size

76KB
MD5

c59cdbed359e346d47997d9641ee83db
SHA1

ad2adf2ce0be1f6e926f0ab948187cda3059614d
SHA256

e78bc392a0ab09d81926e935020b05f759aa42859524084c26f36718db6a60b6
SHA512

6084bd6180a2c90df81abb21328603f0c87cbe77b282f29fbe521cd7f145fca60a0a5c6d18b72acc358d2cb198f941e0da65eb66fb78e8ab3f68e662ea1c0226
SSDEEP

1536:u/ePyXHZ7DA4BfBrmTiXvvvUgbFNCuACP1DIgN:seSHZ7DTBfBrB/UgbFNCuAq2C

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	2740	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 1696	2740	c59cdbed359e346d47997d9641ee83db.exe	28
PID 2740 wrote to memory of 1696	2740	c59cdbed359e346d47997d9641ee83db.exe	28
PID 2740 wrote to memory of 1696	2740	c59cdbed359e346d47997d9641ee83db.exe	28
PID 2740 wrote to memory of 1696	2740	c59cdbed359e346d47997d9641ee83db.exe	28

C:\Users\Admin\AppData\Local\Temp\c59cdbed359e346d47997d9641ee83db.exe
"C:\Users\Admin\AppData\Local\Temp\c59cdbed359e346d47997d9641ee83db.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 108
  2⤵
  - Program crash
  PID:1696

memory/2740-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2740-1-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download