9d64ea042d6b8af58f242f78547e3feaccd5cc4bdc1b78d6325f8211e659a272

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 16:59

Target

9d64ea042d6b8af58f242f78547e3feaccd5cc4bdc1b78d6325f8211e659a272.exe
Size

67KB
MD5

048faa2d6d35efa908b551022cf744d6
SHA1

48bb768b002cea625cd2d0506b2dc55e6517593c
SHA256

9d64ea042d6b8af58f242f78547e3feaccd5cc4bdc1b78d6325f8211e659a272
SHA512

2335ba2f527a89a2841f89153ece2e069ac195985394baf27a4b24a588bd4a5fe75c111b19dd3dac193bd9079b3330c0b1e6c3cd4585acaaf1a5848da05811c4
SSDEEP

1536:qBIElQ54B1G4aTSytxjXLAx8vdMXi5/MseK:YlQb41yrAKl20/MTK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
944	1696	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 944	1696	9d64ea042d6b8af58f242f78547e3feaccd5cc4bdc1b78d6325f8211e659a272.exe	27
PID 1696 wrote to memory of 944	1696	9d64ea042d6b8af58f242f78547e3feaccd5cc4bdc1b78d6325f8211e659a272.exe	27
PID 1696 wrote to memory of 944	1696	9d64ea042d6b8af58f242f78547e3feaccd5cc4bdc1b78d6325f8211e659a272.exe	27
PID 1696 wrote to memory of 944	1696	9d64ea042d6b8af58f242f78547e3feaccd5cc4bdc1b78d6325f8211e659a272.exe	27

C:\Users\Admin\AppData\Local\Temp\9d64ea042d6b8af58f242f78547e3feaccd5cc4bdc1b78d6325f8211e659a272.exe
"C:\Users\Admin\AppData\Local\Temp\9d64ea042d6b8af58f242f78547e3feaccd5cc4bdc1b78d6325f8211e659a272.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 36
  2⤵
  - Program crash
  PID:944

memory/1696-55-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download