7c9dd26744d4d61a3f98520284906beac5b0851e1541fd6f045c486a117a5a8a

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 14:20

Target

7c9dd26744d4d61a3f98520284906beac5b0851e1541fd6f045c486a117a5a8a.exe
Size

214KB
MD5

a4551ac4c72b379d7a426984ff31d51f
SHA1

0d1c1b64b098549de185d704427803b8abd3ae79
SHA256

7c9dd26744d4d61a3f98520284906beac5b0851e1541fd6f045c486a117a5a8a
SHA512

27e1ec7f2b4527949194c7dc7c6f358ff690711b7a4c3071a1ee417f5befd7b4b159418fbfc293e2363a5c3ac070863428e68e8f99962004d39b4d62dbf8baea
SSDEEP

3072:whNGEHQz2oRoG7lxOEXePqouymjqrhojezC1QJMT7mpGJ/7hrTiPs5KMhKIoC8Rf:oN7J6YYBoh5rjId7mpA7s0f0CqNCE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1560	1344	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 1560	1344	7c9dd26744d4d61a3f98520284906beac5b0851e1541fd6f045c486a117a5a8a.exe	26
PID 1344 wrote to memory of 1560	1344	7c9dd26744d4d61a3f98520284906beac5b0851e1541fd6f045c486a117a5a8a.exe	26
PID 1344 wrote to memory of 1560	1344	7c9dd26744d4d61a3f98520284906beac5b0851e1541fd6f045c486a117a5a8a.exe	26
PID 1344 wrote to memory of 1560	1344	7c9dd26744d4d61a3f98520284906beac5b0851e1541fd6f045c486a117a5a8a.exe	26

C:\Users\Admin\AppData\Local\Temp\7c9dd26744d4d61a3f98520284906beac5b0851e1541fd6f045c486a117a5a8a.exe
"C:\Users\Admin\AppData\Local\Temp\7c9dd26744d4d61a3f98520284906beac5b0851e1541fd6f045c486a117a5a8a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 36
  2⤵
  - Program crash
  PID:1560

memory/1344-55-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download