e9980121afcdf89bf06612769f21006dd0975a1f38039351720df61532018488

Analysis

max time kernel
38s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:33

Target

e9980121afcdf89bf06612769f21006dd0975a1f38039351720df61532018488.exe
Size

5KB
MD5

adc42f78ffcf9a03fa55c4809c725cfa
SHA1

9c137c30ed72a3ddbc02cba00fcbc993d7231810
SHA256

e9980121afcdf89bf06612769f21006dd0975a1f38039351720df61532018488
SHA512

f982c09d18a6d1f254aee66b39b6e7fb0da96a0f3f4bd642ce2e9b67989c3f7b6eb092af990e8ad33ef4ade6facf32914757ee3400cc502e185ca38b158ac8bb
SSDEEP

96:R8L/Jp0/J4RlhLXV7DMyuIkfrcNRi64zwKvdqtwdYKpJ7DEJkpddszvA:wJIJaxdw9uRi5kmdYiBDqq

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

296 1140 WerFault.exe e9980121afcdf89bf06612769f21006dd0975a1f38039351720df61532018488.exe

pid	pid_target	process	target process
296	1140	WerFault.exe	e9980121afcdf89bf06612769f21006dd0975a1f38039351720df61532018488.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e9980121afcdf89bf06612769f21006dd0975a1f38039351720df61532018488.exe

description	pid	process	target process
PID 1140 wrote to memory of 296	1140	e9980121afcdf89bf06612769f21006dd0975a1f38039351720df61532018488.exe	WerFault.exe
PID 1140 wrote to memory of 296	1140	e9980121afcdf89bf06612769f21006dd0975a1f38039351720df61532018488.exe	WerFault.exe
PID 1140 wrote to memory of 296	1140	e9980121afcdf89bf06612769f21006dd0975a1f38039351720df61532018488.exe	WerFault.exe
PID 1140 wrote to memory of 296	1140	e9980121afcdf89bf06612769f21006dd0975a1f38039351720df61532018488.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e9980121afcdf89bf06612769f21006dd0975a1f38039351720df61532018488.exe
"C:\Users\Admin\AppData\Local\Temp\e9980121afcdf89bf06612769f21006dd0975a1f38039351720df61532018488.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 36
2⤵
- Program crash
PID:296

memory/296-55-0x0000000000000000-mapping.dmp

Download
memory/1140-54-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download