c9e479e0496e4627e535d14dfabcdfa76642a8b29d9af6ac6b58a6ae3bbb258a

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:20

Target

c9e479e0496e4627e535d14dfabcdfa76642a8b29d9af6ac6b58a6ae3bbb258a.exe
Size

62KB
MD5

b547fbb505f6292b84b40fd52961db86
SHA1

4bcbcd1d6074cce09adf64c8f22fe54cd58bd75c
SHA256

c9e479e0496e4627e535d14dfabcdfa76642a8b29d9af6ac6b58a6ae3bbb258a
SHA512

48bbdbd624e5de76346a88790789826e568ba036e064e76a7cdbfc80debcbe8b2377c94338a062298500b7dc44a4026da0e26808056bc9ba89486c6644e4e4a0
SSDEEP

1536:FKl0JLAXDhPTV8ueMbVKRjZqb6pkSaA6pD/E6xM:FgXD5R8ueMbVCNdpkH9/E2M

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1276 1340 WerFault.exe c9e479e0496e4627e535d14dfabcdfa76642a8b29d9af6ac6b58a6ae3bbb258a.exe

pid	pid_target	process	target process
1276	1340	WerFault.exe	c9e479e0496e4627e535d14dfabcdfa76642a8b29d9af6ac6b58a6ae3bbb258a.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c9e479e0496e4627e535d14dfabcdfa76642a8b29d9af6ac6b58a6ae3bbb258a.exe

description	pid	process	target process
PID 1340 wrote to memory of 1276	1340	c9e479e0496e4627e535d14dfabcdfa76642a8b29d9af6ac6b58a6ae3bbb258a.exe	WerFault.exe
PID 1340 wrote to memory of 1276	1340	c9e479e0496e4627e535d14dfabcdfa76642a8b29d9af6ac6b58a6ae3bbb258a.exe	WerFault.exe
PID 1340 wrote to memory of 1276	1340	c9e479e0496e4627e535d14dfabcdfa76642a8b29d9af6ac6b58a6ae3bbb258a.exe	WerFault.exe
PID 1340 wrote to memory of 1276	1340	c9e479e0496e4627e535d14dfabcdfa76642a8b29d9af6ac6b58a6ae3bbb258a.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c9e479e0496e4627e535d14dfabcdfa76642a8b29d9af6ac6b58a6ae3bbb258a.exe
"C:\Users\Admin\AppData\Local\Temp\c9e479e0496e4627e535d14dfabcdfa76642a8b29d9af6ac6b58a6ae3bbb258a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 36
2⤵
- Program crash
PID:1276

memory/1276-54-0x0000000000000000-mapping.dmp

Download
memory/1340-55-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download