0f91073d9ad6498a17865daf65964303d5212dbf2fae0aa53793b463478371c6

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 18:21

Target

0f91073d9ad6498a17865daf65964303d5212dbf2fae0aa53793b463478371c6.exe
Size

32KB
MD5

7fa464f3914deb71fcd21cd6c9de918c
SHA1

4e152c9a9df3ee13a92c2f2b36b544a50ad03d11
SHA256

0f91073d9ad6498a17865daf65964303d5212dbf2fae0aa53793b463478371c6
SHA512

2979d8bc33608c28115fdce61044230d40c6f36158ebe520cbf1a99d196582d2941a30de11df834102d6268fd024b62a825844928d0470fe37dd72c69d28dee5
SSDEEP

96:oLy84iQd6OeD8nN+FEEfdzpFJc+6qQQX1GzfMchgQ:KMd6Oh8b1ipIGrkQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1956	2024	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 1956	2024	0f91073d9ad6498a17865daf65964303d5212dbf2fae0aa53793b463478371c6.exe	26
PID 2024 wrote to memory of 1956	2024	0f91073d9ad6498a17865daf65964303d5212dbf2fae0aa53793b463478371c6.exe	26
PID 2024 wrote to memory of 1956	2024	0f91073d9ad6498a17865daf65964303d5212dbf2fae0aa53793b463478371c6.exe	26
PID 2024 wrote to memory of 1956	2024	0f91073d9ad6498a17865daf65964303d5212dbf2fae0aa53793b463478371c6.exe	26

C:\Users\Admin\AppData\Local\Temp\0f91073d9ad6498a17865daf65964303d5212dbf2fae0aa53793b463478371c6.exe
"C:\Users\Admin\AppData\Local\Temp\0f91073d9ad6498a17865daf65964303d5212dbf2fae0aa53793b463478371c6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 88
  2⤵
  - Program crash
  PID:1956