58260a6687486e39dc46461270b391280b7d59997d84b6639230d95e3bdfca23

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06-05-2024 12:02

Target

58260a6687486e39dc46461270b391280b7d59997d84b6639230d95e3bdfca23.exe
Size

144KB
MD5

80eeb191abe38686038db7946e49774c
SHA1

49d136f1167ede48ebe38788030e40f8001f404a
SHA256

58260a6687486e39dc46461270b391280b7d59997d84b6639230d95e3bdfca23
SHA512

9df0a4ca0bea6f0f1a7e9f134fc67e68d1a52b0b2822e8a7e06c449d33993df2ba06bfb091190b311a40fc84208e14fb042cf98df140d87ede7056db575e56c1
SSDEEP

3072:ZqJogYkcSNm9VoDPyhnBhMFE5fv0PfFYZZkT:Zq2kc4m9iDeBkEt0PfaH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1276	1868	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 1276	1868	58260a6687486e39dc46461270b391280b7d59997d84b6639230d95e3bdfca23.exe	28
PID 1868 wrote to memory of 1276	1868	58260a6687486e39dc46461270b391280b7d59997d84b6639230d95e3bdfca23.exe	28
PID 1868 wrote to memory of 1276	1868	58260a6687486e39dc46461270b391280b7d59997d84b6639230d95e3bdfca23.exe	28
PID 1868 wrote to memory of 1276	1868	58260a6687486e39dc46461270b391280b7d59997d84b6639230d95e3bdfca23.exe	28

C:\Users\Admin\AppData\Local\Temp\58260a6687486e39dc46461270b391280b7d59997d84b6639230d95e3bdfca23.exe
"C:\Users\Admin\AppData\Local\Temp\58260a6687486e39dc46461270b391280b7d59997d84b6639230d95e3bdfca23.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 88
  2⤵
  - Program crash
  PID:1276