3078a3817523b0307884277de94c6994846d9caf7221e2d94afcc40d758df6a5

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/11/2022, 20:29

Target

9db181855ed609d88cf9ade5f9f1e9ea8a2d000100c59882f37d74384d012add.exe
Size

1.2MB
MD5

c17b10b6400f10ad002f1f35275f3581
SHA1

e122a9c179645888b60d8559603450226be65811
SHA256

9db181855ed609d88cf9ade5f9f1e9ea8a2d000100c59882f37d74384d012add
SHA512

fa15bfd1e80411a5de7e879988915859a1d008240141f6b9da7df155ddd8417ffdff249e3e1abe6abe0486aa3454386f553b1e1b7660317081fdbb344bc7a2f0
SSDEEP

24576:+WQghSA9kA5oZI/L99Xz0O3vlFwwMSY+pkUvgT8nu3Th1:+VUSnAOZI3zR3dFUV+pkTQnW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
900	1088	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 900	1088	9db181855ed609d88cf9ade5f9f1e9ea8a2d000100c59882f37d74384d012add.exe	28
PID 1088 wrote to memory of 900	1088	9db181855ed609d88cf9ade5f9f1e9ea8a2d000100c59882f37d74384d012add.exe	28
PID 1088 wrote to memory of 900	1088	9db181855ed609d88cf9ade5f9f1e9ea8a2d000100c59882f37d74384d012add.exe	28
PID 1088 wrote to memory of 900	1088	9db181855ed609d88cf9ade5f9f1e9ea8a2d000100c59882f37d74384d012add.exe	28

C:\Users\Admin\AppData\Local\Temp\9db181855ed609d88cf9ade5f9f1e9ea8a2d000100c59882f37d74384d012add.exe
"C:\Users\Admin\AppData\Local\Temp\9db181855ed609d88cf9ade5f9f1e9ea8a2d000100c59882f37d74384d012add.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 580
  2⤵
  - Program crash
  PID:900

memory/1088-54-0x0000000000810000-0x0000000000942000-memory.dmp

Filesize
1.2MB

Download
memory/1088-55-0x0000000006ED0000-0x0000000007034000-memory.dmp

Filesize
1.4MB

Download