7e9133537cee1206fc2e00aa9c7e369ce39666070074e392e3a9ec758fba0a92

Analysis

max time kernel
205s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 22:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e9133537cee1206fc2e00aa9c7e369ce39666070074e392e3a9ec758fba0a92.exe
Size

122KB
MD5

a540753cc4d39923f7df64f9a8c63c11
SHA1

c1e12e609f0546ab2ba2f32ab28e038e73c5c4f2
SHA256

7e9133537cee1206fc2e00aa9c7e369ce39666070074e392e3a9ec758fba0a92
SHA512

ff336e9b559daee5bd3b1f7fa7e62e21e18409d02d3beed5db82b5fb1c5931f29a64bdbb37abdbcaa20039bf1ba1e54fd9b26497784fb858b5ab37d33e313665
SSDEEP

3072:rb/QvqGIx+BjfRkiU4KgrXBwsAkq/BlCyr/0MT2O:rLQvqGI5iU4KUBwsAkQr/0w2O

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2736	4820	WerFault.exe	87

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 4972	2932	7e9133537cee1206fc2e00aa9c7e369ce39666070074e392e3a9ec758fba0a92.exe	83
PID 2932 wrote to memory of 4972	2932	7e9133537cee1206fc2e00aa9c7e369ce39666070074e392e3a9ec758fba0a92.exe	83
PID 2932 wrote to memory of 4972	2932	7e9133537cee1206fc2e00aa9c7e369ce39666070074e392e3a9ec758fba0a92.exe	83
PID 4972 wrote to memory of 1036	4972	7e9133537cee1206fc2e00aa9c7e369ce39666070074e392e3a9ec758fba0a92.exe	84
PID 4972 wrote to memory of 1036	4972	7e9133537cee1206fc2e00aa9c7e369ce39666070074e392e3a9ec758fba0a92.exe	84
PID 4972 wrote to memory of 1036	4972	7e9133537cee1206fc2e00aa9c7e369ce39666070074e392e3a9ec758fba0a92.exe	84
PID 1036 wrote to memory of 212	1036	7e9133537cee1206fc2e00aa9c7e369ce39666070074e392e3a9ec758fba0a92.exe	85
PID 1036 wrote to memory of 212	1036	7e9133537cee1206fc2e00aa9c7e369ce39666070074e392e3a9ec758fba0a92.exe	85
PID 1036 wrote to memory of 212	1036	7e9133537cee1206fc2e00aa9c7e369ce39666070074e392e3a9ec758fba0a92.exe	85
PID 212 wrote to memory of 32	212	7e9133537cee1206fc2e00aa9c7e369ce39666070074e392e3a9ec758fba0a92.exe	86
PID 212 wrote to memory of 32	212	7e9133537cee1206fc2e00aa9c7e369ce39666070074e392e3a9ec758fba0a92.exe	86
PID 212 wrote to memory of 32	212	7e9133537cee1206fc2e00aa9c7e369ce39666070074e392e3a9ec758fba0a92.exe	86
PID 32 wrote to memory of 4820	32	7e9133537cee1206fc2e00aa9c7e369ce39666070074e392e3a9ec758fba0a92.exe	87
PID 32 wrote to memory of 4820	32	7e9133537cee1206fc2e00aa9c7e369ce39666070074e392e3a9ec758fba0a92.exe	87
PID 32 wrote to memory of 4820	32	7e9133537cee1206fc2e00aa9c7e369ce39666070074e392e3a9ec758fba0a92.exe	87

C:\Users\Admin\AppData\Local\Temp\7e9133537cee1206fc2e00aa9c7e369ce39666070074e392e3a9ec758fba0a92.exe
"C:\Users\Admin\AppData\Local\Temp\7e9133537cee1206fc2e00aa9c7e369ce39666070074e392e3a9ec758fba0a92.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\7e9133537cee1206fc2e00aa9c7e369ce39666070074e392e3a9ec758fba0a92.exe
  1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Users\Admin\AppData\Local\Temp\7e9133537cee1206fc2e00aa9c7e369ce39666070074e392e3a9ec758fba0a92.exe
    2
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1036
  - - C:\Users\Admin\AppData\Local\Temp\7e9133537cee1206fc2e00aa9c7e369ce39666070074e392e3a9ec758fba0a92.exe
      3
      4⤵
      Suspicious use of WriteProcessMemory
      PID:212
    - - C:\Users\Admin\AppData\Local\Temp\7e9133537cee1206fc2e00aa9c7e369ce39666070074e392e3a9ec758fba0a92.exe
        
        4
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:32
      - C:\Users\Admin\AppData\Local\Temp\7e9133537cee1206fc2e00aa9c7e369ce39666070074e392e3a9ec758fba0a92.exe
        
        5
        6⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 232
        7⤵
        Program crash
        
        PID:2736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4820 -ip 4820
1⤵
PID:4604

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads