9c024ca4b3b6393832b519b6edb74663059f2fba6d78fbbd67811efccf963dd8

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/11/2022, 06:21

Target

9c024ca4b3b6393832b519b6edb74663059f2fba6d78fbbd67811efccf963dd8.exe
Size

174KB
MD5

0d750d136995a6071f5d102ded4c1f49
SHA1

08e01c52526462fbe5c4dc276f870f40e9bd7c98
SHA256

9c024ca4b3b6393832b519b6edb74663059f2fba6d78fbbd67811efccf963dd8
SHA512

4aa261b781b53a8dd51dd69c8d02b27c0899fc82670973a597f9b1b150adc34d33e0f347f8cacf52be65368d11ca9fb91f4a8a8d02ee7dfd27e777498326815b
SSDEEP

3072:KZ/LhS0rKgHq+rFLIwgoovufDUbZVYIWJkQn5Se:+/LhS0rKE/FLITo9mAIWWQh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1472	1116	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 1472	1116	9c024ca4b3b6393832b519b6edb74663059f2fba6d78fbbd67811efccf963dd8.exe	28
PID 1116 wrote to memory of 1472	1116	9c024ca4b3b6393832b519b6edb74663059f2fba6d78fbbd67811efccf963dd8.exe	28
PID 1116 wrote to memory of 1472	1116	9c024ca4b3b6393832b519b6edb74663059f2fba6d78fbbd67811efccf963dd8.exe	28
PID 1116 wrote to memory of 1472	1116	9c024ca4b3b6393832b519b6edb74663059f2fba6d78fbbd67811efccf963dd8.exe	28

C:\Users\Admin\AppData\Local\Temp\9c024ca4b3b6393832b519b6edb74663059f2fba6d78fbbd67811efccf963dd8.exe
"C:\Users\Admin\AppData\Local\Temp\9c024ca4b3b6393832b519b6edb74663059f2fba6d78fbbd67811efccf963dd8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 172
  2⤵
  - Program crash
  PID:1472

memory/1116-54-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download