9245d1530e0a608d0c8ecd9f4e51ae8b36176d20e1f2e4134d52a35694b0f4f2

Analysis

max time kernel
11s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 12:23

Target

9245d1530e0a608d0c8ecd9f4e51ae8b36176d20e1f2e4134d52a35694b0f4f2.exe
Size

28KB
MD5

f24504004a697428b9d2f5604406cab1
SHA1

0f7d5e7886446bba56890ab7c3005f1f71700850
SHA256

9245d1530e0a608d0c8ecd9f4e51ae8b36176d20e1f2e4134d52a35694b0f4f2
SHA512

8f6af814cdb3e9e1fbb23b62abf44ef6b72a67db212cf1f5c9a7b951c727191e1cbad23cea8bb1b168aaf4716856c71e9b029d008acdce399f35bea1a4255e4e
SSDEEP

6:iz3SsEb7O2eApxE+LPN2BORIBvuJKQmQbx+gw+jt0gWp+tus:wa7OW/E+JWORIBvuJ5bx+9+50EB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
836	1812	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 836	1812	9245d1530e0a608d0c8ecd9f4e51ae8b36176d20e1f2e4134d52a35694b0f4f2.exe	28
PID 1812 wrote to memory of 836	1812	9245d1530e0a608d0c8ecd9f4e51ae8b36176d20e1f2e4134d52a35694b0f4f2.exe	28
PID 1812 wrote to memory of 836	1812	9245d1530e0a608d0c8ecd9f4e51ae8b36176d20e1f2e4134d52a35694b0f4f2.exe	28
PID 1812 wrote to memory of 836	1812	9245d1530e0a608d0c8ecd9f4e51ae8b36176d20e1f2e4134d52a35694b0f4f2.exe	28

C:\Users\Admin\AppData\Local\Temp\9245d1530e0a608d0c8ecd9f4e51ae8b36176d20e1f2e4134d52a35694b0f4f2.exe
"C:\Users\Admin\AppData\Local\Temp\9245d1530e0a608d0c8ecd9f4e51ae8b36176d20e1f2e4134d52a35694b0f4f2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 88
  2⤵
  - Program crash
  PID:836

memory/1812-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download