9e8eb5bfa59e5c04745907d84b09cfe5c1be97ccebd41ca2d62d762742b20672

Analysis

max time kernel
14s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 22:00

Target

9e8eb5bfa59e5c04745907d84b09cfe5c1be97ccebd41ca2d62d762742b20672.exe
Size

119KB
MD5

5acfb270b63bdbf9d105edad4efa8577
SHA1

f51b95d120acd75ceaafbf5929b81f7a1825a761
SHA256

9e8eb5bfa59e5c04745907d84b09cfe5c1be97ccebd41ca2d62d762742b20672
SHA512

a6cd1c074eba2293fe869cd9bc738658ad2220c954df5341c989c93db6e83675801571a1e3affd2cff22b6722b1fd22af31a32f2ac450478ad85776d23b70565
SSDEEP

1536:oGw8eWe2KCh6I9pbzo09i3RTsSjKCp/8dqIpjVrs2ryrd1vUQuqSSqK5tnCvv:oGwzpCh6QVk09G1raqIHs2qxnC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2036	1792	WerFault.exe	21

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2036	1792	9e8eb5bfa59e5c04745907d84b09cfe5c1be97ccebd41ca2d62d762742b20672.exe	28
PID 1792 wrote to memory of 2036	1792	9e8eb5bfa59e5c04745907d84b09cfe5c1be97ccebd41ca2d62d762742b20672.exe	28
PID 1792 wrote to memory of 2036	1792	9e8eb5bfa59e5c04745907d84b09cfe5c1be97ccebd41ca2d62d762742b20672.exe	28
PID 1792 wrote to memory of 2036	1792	9e8eb5bfa59e5c04745907d84b09cfe5c1be97ccebd41ca2d62d762742b20672.exe	28

C:\Users\Admin\AppData\Local\Temp\9e8eb5bfa59e5c04745907d84b09cfe5c1be97ccebd41ca2d62d762742b20672.exe
"C:\Users\Admin\AppData\Local\Temp\9e8eb5bfa59e5c04745907d84b09cfe5c1be97ccebd41ca2d62d762742b20672.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 36
  2⤵
  - Program crash
  PID:2036

memory/1792-55-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download