e9fd5cb2e7dc29b58e3aac31863de9fd098c750d742d200fd6a6c3b7da2223df

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 16:58

Target

e9fd5cb2e7dc29b58e3aac31863de9fd098c750d742d200fd6a6c3b7da2223df.exe
Size

190KB
MD5

5376699cfc6c2fc1bd14abba93bcdd0d
SHA1

0af5a4ea5ea4ad7d0838d98fec3a25bf629da695
SHA256

e9fd5cb2e7dc29b58e3aac31863de9fd098c750d742d200fd6a6c3b7da2223df
SHA512

aa36d1bf71f0e9e3ab7c52f451a4df4c6f517dd0a6c68dac89163cfd277d97d6f7ea5156394a15d5058676616e4985f8e16f7248fbb9be10e893ad2b4ecaff90
SSDEEP

3072:m7B3DAuocS/28JSA0YITO7LQdhMceV4dl88AHWSJvfk3Gn7KM3oMsGX2XvWEKx:YBkXTAAxb7LwhMc5sNvf5oMsO2FI

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

876 992 WerFault.exe e9fd5cb2e7dc29b58e3aac31863de9fd098c750d742d200fd6a6c3b7da2223df.exe

pid	pid_target	process	target process
876	992	WerFault.exe	e9fd5cb2e7dc29b58e3aac31863de9fd098c750d742d200fd6a6c3b7da2223df.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e9fd5cb2e7dc29b58e3aac31863de9fd098c750d742d200fd6a6c3b7da2223df.exe

description	pid	process	target process
PID 992 wrote to memory of 876	992	e9fd5cb2e7dc29b58e3aac31863de9fd098c750d742d200fd6a6c3b7da2223df.exe	WerFault.exe
PID 992 wrote to memory of 876	992	e9fd5cb2e7dc29b58e3aac31863de9fd098c750d742d200fd6a6c3b7da2223df.exe	WerFault.exe
PID 992 wrote to memory of 876	992	e9fd5cb2e7dc29b58e3aac31863de9fd098c750d742d200fd6a6c3b7da2223df.exe	WerFault.exe
PID 992 wrote to memory of 876	992	e9fd5cb2e7dc29b58e3aac31863de9fd098c750d742d200fd6a6c3b7da2223df.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e9fd5cb2e7dc29b58e3aac31863de9fd098c750d742d200fd6a6c3b7da2223df.exe
"C:\Users\Admin\AppData\Local\Temp\e9fd5cb2e7dc29b58e3aac31863de9fd098c750d742d200fd6a6c3b7da2223df.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 88
2⤵
- Program crash
PID:876