c9ea95c31e87f2460ad7e4e973a7f8003101f7b45055c3f018cb38731df9595f

Analysis

max time kernel
3s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:17

Target

c9ea95c31e87f2460ad7e4e973a7f8003101f7b45055c3f018cb38731df9595f.exe
Size

76KB
MD5

777e0de17757e94bb01e136a2d6b22e4
SHA1

e7793b8794a0d371ebad3d1c6ec91f4ceb53f430
SHA256

c9ea95c31e87f2460ad7e4e973a7f8003101f7b45055c3f018cb38731df9595f
SHA512

a2833937043b226de2872809ef1cdd7522499439d7c0ca31675f3a89f95e6c08cc30ee4ad07c009c383cec5422827cec796e29b212990cec7e2c20973a8eef35
SSDEEP

1536:V3bsn4yA0wZs3qjoqi6OJ0y+TB10+GnpjVrs2ryrd1vUQuq6:Vbs4yBGs3Xq1OoBm+KHs2qo

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

584 772 WerFault.exe c9ea95c31e87f2460ad7e4e973a7f8003101f7b45055c3f018cb38731df9595f.exe

pid	pid_target	process	target process
584	772	WerFault.exe	c9ea95c31e87f2460ad7e4e973a7f8003101f7b45055c3f018cb38731df9595f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c9ea95c31e87f2460ad7e4e973a7f8003101f7b45055c3f018cb38731df9595f.exe

description	pid	process	target process
PID 772 wrote to memory of 584	772	c9ea95c31e87f2460ad7e4e973a7f8003101f7b45055c3f018cb38731df9595f.exe	WerFault.exe
PID 772 wrote to memory of 584	772	c9ea95c31e87f2460ad7e4e973a7f8003101f7b45055c3f018cb38731df9595f.exe	WerFault.exe
PID 772 wrote to memory of 584	772	c9ea95c31e87f2460ad7e4e973a7f8003101f7b45055c3f018cb38731df9595f.exe	WerFault.exe
PID 772 wrote to memory of 584	772	c9ea95c31e87f2460ad7e4e973a7f8003101f7b45055c3f018cb38731df9595f.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c9ea95c31e87f2460ad7e4e973a7f8003101f7b45055c3f018cb38731df9595f.exe
"C:\Users\Admin\AppData\Local\Temp\c9ea95c31e87f2460ad7e4e973a7f8003101f7b45055c3f018cb38731df9595f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 36
2⤵
- Program crash
PID:584

memory/584-54-0x0000000000000000-mapping.dmp

Download
memory/772-55-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download