9ab6dce55169cae512bdb76f7bfb5953ac1bd0d4fc1c743d43f2e80d1caffbc6

Analysis

max time kernel
87s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:44

Target

9ab6dce55169cae512bdb76f7bfb5953ac1bd0d4fc1c743d43f2e80d1caffbc6.exe
Size

176KB
MD5

52a8aca24968cdd79f07b12afef8f850
SHA1

8bc16d53801f6c4095d21e800b0d7093e4aca405
SHA256

9ab6dce55169cae512bdb76f7bfb5953ac1bd0d4fc1c743d43f2e80d1caffbc6
SHA512

cf2af4cf1d2553e1a17ddc99fa32f0f999931c7398dcd1d76ef08a6584bfbc16611c50684ad14d920f500476c8d111c6979101ccb8b86b4a20930545edcc2c55
SSDEEP

3072:hk5WlGHikwvcIgkey3HWA8ZGlLoLiKW54:hcWlGCkzIJPHp8ZkL2F

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

428 1212 WerFault.exe 9ab6dce55169cae512bdb76f7bfb5953ac1bd0d4fc1c743d43f2e80d1caffbc6.exe

pid	pid_target	process	target process
428	1212	WerFault.exe	9ab6dce55169cae512bdb76f7bfb5953ac1bd0d4fc1c743d43f2e80d1caffbc6.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

9ab6dce55169cae512bdb76f7bfb5953ac1bd0d4fc1c743d43f2e80d1caffbc6.exe

description	pid	process	target process
PID 1212 wrote to memory of 428	1212	9ab6dce55169cae512bdb76f7bfb5953ac1bd0d4fc1c743d43f2e80d1caffbc6.exe	WerFault.exe
PID 1212 wrote to memory of 428	1212	9ab6dce55169cae512bdb76f7bfb5953ac1bd0d4fc1c743d43f2e80d1caffbc6.exe	WerFault.exe
PID 1212 wrote to memory of 428	1212	9ab6dce55169cae512bdb76f7bfb5953ac1bd0d4fc1c743d43f2e80d1caffbc6.exe	WerFault.exe
PID 1212 wrote to memory of 428	1212	9ab6dce55169cae512bdb76f7bfb5953ac1bd0d4fc1c743d43f2e80d1caffbc6.exe	WerFault.exe
PID 1212 wrote to memory of 428	1212	9ab6dce55169cae512bdb76f7bfb5953ac1bd0d4fc1c743d43f2e80d1caffbc6.exe	WerFault.exe
PID 1212 wrote to memory of 428	1212	9ab6dce55169cae512bdb76f7bfb5953ac1bd0d4fc1c743d43f2e80d1caffbc6.exe	WerFault.exe
PID 1212 wrote to memory of 428	1212	9ab6dce55169cae512bdb76f7bfb5953ac1bd0d4fc1c743d43f2e80d1caffbc6.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9ab6dce55169cae512bdb76f7bfb5953ac1bd0d4fc1c743d43f2e80d1caffbc6.exe
"C:\Users\Admin\AppData\Local\Temp\9ab6dce55169cae512bdb76f7bfb5953ac1bd0d4fc1c743d43f2e80d1caffbc6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 280
2⤵
- Program crash
PID:428

memory/428-55-0x0000000000000000-mapping.dmp

Download
memory/1212-54-0x0000000074ED1000-0x0000000074ED3000-memory.dmp

Filesize
8KB

Download
memory/1212-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1212-57-0x00000000002D0000-0x0000000000304000-memory.dmp

Filesize
208KB

Download