9cac78aaa09546f637f4bbb7f70c032c98901159a6434174d58f4234566521d4

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 12:31

Target

9cac78aaa09546f637f4bbb7f70c032c98901159a6434174d58f4234566521d4.exe
Size

66KB
MD5

a34368801eaeb9cd492bd6c0256bd887
SHA1

c42efcb736b94d2a8ac762de946422288d13c33e
SHA256

9cac78aaa09546f637f4bbb7f70c032c98901159a6434174d58f4234566521d4
SHA512

5d7fd161a6233e7a1665e27192e76a866819932926a5884d0f76f75b5f2d1a6ad187d32004e299dab9f8b27169b4c89422ec06404daf43a3130a3bc2b946bcfa
SSDEEP

1536:np4Q0bKiJXG3iIoVxhfI991FaqdZAy86zYVsQNXY8:n+HDDhQr1FapN6E/X1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1344	1204	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1344	1204	9cac78aaa09546f637f4bbb7f70c032c98901159a6434174d58f4234566521d4.exe	27
PID 1204 wrote to memory of 1344	1204	9cac78aaa09546f637f4bbb7f70c032c98901159a6434174d58f4234566521d4.exe	27
PID 1204 wrote to memory of 1344	1204	9cac78aaa09546f637f4bbb7f70c032c98901159a6434174d58f4234566521d4.exe	27
PID 1204 wrote to memory of 1344	1204	9cac78aaa09546f637f4bbb7f70c032c98901159a6434174d58f4234566521d4.exe	27

C:\Users\Admin\AppData\Local\Temp\9cac78aaa09546f637f4bbb7f70c032c98901159a6434174d58f4234566521d4.exe
"C:\Users\Admin\AppData\Local\Temp\9cac78aaa09546f637f4bbb7f70c032c98901159a6434174d58f4234566521d4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 36
  2⤵
  - Program crash
  PID:1344

memory/1204-55-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download