e9b50d66ce5f899853ffd719bf206a4a291e399f33c8ef76bd0c0c093e06c052

Analysis

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:17

Target

e9b50d66ce5f899853ffd719bf206a4a291e399f33c8ef76bd0c0c093e06c052.exe
Size

61KB
MD5

7d9bc37376857c8910b15b13a647d097
SHA1

e1fbfd32a34cbac6bebd7feb35d9dfe6bbd38179
SHA256

e9b50d66ce5f899853ffd719bf206a4a291e399f33c8ef76bd0c0c093e06c052
SHA512

5d2598f7ad1302bee7e66e9cc78ba5d45e135a8c381d02130c2003f83094026b0ea878a45a848fdd298b6ef38689b0fc5e6933139ac1ffec98824556df3107e4
SSDEEP

1536:K8IAWlZY/0DWZ2v2HM7a3l32CV+XCQiRz7ix:YAWk8VWsC32CV0yk

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1240 1756 WerFault.exe e9b50d66ce5f899853ffd719bf206a4a291e399f33c8ef76bd0c0c093e06c052.exe

pid	pid_target	process	target process
1240	1756	WerFault.exe	e9b50d66ce5f899853ffd719bf206a4a291e399f33c8ef76bd0c0c093e06c052.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e9b50d66ce5f899853ffd719bf206a4a291e399f33c8ef76bd0c0c093e06c052.exe

description	pid	process	target process
PID 1756 wrote to memory of 1240	1756	e9b50d66ce5f899853ffd719bf206a4a291e399f33c8ef76bd0c0c093e06c052.exe	WerFault.exe
PID 1756 wrote to memory of 1240	1756	e9b50d66ce5f899853ffd719bf206a4a291e399f33c8ef76bd0c0c093e06c052.exe	WerFault.exe
PID 1756 wrote to memory of 1240	1756	e9b50d66ce5f899853ffd719bf206a4a291e399f33c8ef76bd0c0c093e06c052.exe	WerFault.exe
PID 1756 wrote to memory of 1240	1756	e9b50d66ce5f899853ffd719bf206a4a291e399f33c8ef76bd0c0c093e06c052.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e9b50d66ce5f899853ffd719bf206a4a291e399f33c8ef76bd0c0c093e06c052.exe
"C:\Users\Admin\AppData\Local\Temp\e9b50d66ce5f899853ffd719bf206a4a291e399f33c8ef76bd0c0c093e06c052.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 36
2⤵
- Program crash
PID:1240

memory/1240-54-0x0000000000000000-mapping.dmp

Download
memory/1756-55-0x0000000000400000-0x0000000000425489-memory.dmp

Filesize
149KB

Download