9b7471888463d20157ba5767ab91941258b59a44aad48d972aba5a6dd3b61156

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:41

Target

9b7471888463d20157ba5767ab91941258b59a44aad48d972aba5a6dd3b61156.exe
Size

306KB
MD5

2e30413ad478d1fd41488fb3458d5c8b
SHA1

3e72ee11e42a3544ff1c0440149f935fd4d9d8f8
SHA256

9b7471888463d20157ba5767ab91941258b59a44aad48d972aba5a6dd3b61156
SHA512

93cb372495d3a58b8aa3a62b0980b0adef79b33967d54dd5315dcbfe0f09a4dba7354fa035f5344264bc3861dabf258f9d51efe468eb55af20a183bed09a6e3f
SSDEEP

6144:fhwRbinOm5k70rmUOlUnPB0nnEtbD3IFfq2FQ3AIglGzGkFlp21vI+m8HxSCXR:5yPm58zHENDGfq2q3AIgWLFlaI+JTR

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

912 1788 WerFault.exe 9b7471888463d20157ba5767ab91941258b59a44aad48d972aba5a6dd3b61156.exe

pid	pid_target	process	target process
912	1788	WerFault.exe	9b7471888463d20157ba5767ab91941258b59a44aad48d972aba5a6dd3b61156.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

9b7471888463d20157ba5767ab91941258b59a44aad48d972aba5a6dd3b61156.exe

description	pid	process	target process
PID 1788 wrote to memory of 912	1788	9b7471888463d20157ba5767ab91941258b59a44aad48d972aba5a6dd3b61156.exe	WerFault.exe
PID 1788 wrote to memory of 912	1788	9b7471888463d20157ba5767ab91941258b59a44aad48d972aba5a6dd3b61156.exe	WerFault.exe
PID 1788 wrote to memory of 912	1788	9b7471888463d20157ba5767ab91941258b59a44aad48d972aba5a6dd3b61156.exe	WerFault.exe
PID 1788 wrote to memory of 912	1788	9b7471888463d20157ba5767ab91941258b59a44aad48d972aba5a6dd3b61156.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9b7471888463d20157ba5767ab91941258b59a44aad48d972aba5a6dd3b61156.exe
"C:\Users\Admin\AppData\Local\Temp\9b7471888463d20157ba5767ab91941258b59a44aad48d972aba5a6dd3b61156.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 124
  2⤵
  - Program crash
  PID:912

memory/912-54-0x0000000000000000-mapping.dmp

Download
memory/1788-55-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download