9aa8e3d4a16d4cea0fdc0f5d62979f9c12557444f58e635b990e4ef789c2214c

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 14:45

Target

9aa8e3d4a16d4cea0fdc0f5d62979f9c12557444f58e635b990e4ef789c2214c.exe
Size

39KB
MD5

dc8d3d9f7b817ec30d737f35f5228c4a
SHA1

65a684d6fa40a544c5c1de73ac7176648ae53882
SHA256

9aa8e3d4a16d4cea0fdc0f5d62979f9c12557444f58e635b990e4ef789c2214c
SHA512

5e5e1bd09424b529f65916b0ba19090aa08f0fff617c2e5e76b59de155400649d2bfd3adef2938f6d5bb2cedbc2f1b29e05c1ab79bce0478388f008141ccff6d
SSDEEP

768:VADMvEJWeJh2QQnRTwgfRLs/CT5cz5otMXYY/XxU2ki5ABiDq:VAaEJWChzQntwgJLIh/XxUBie

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
912	1860	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 912	1860	9aa8e3d4a16d4cea0fdc0f5d62979f9c12557444f58e635b990e4ef789c2214c.exe	29
PID 1860 wrote to memory of 912	1860	9aa8e3d4a16d4cea0fdc0f5d62979f9c12557444f58e635b990e4ef789c2214c.exe	29
PID 1860 wrote to memory of 912	1860	9aa8e3d4a16d4cea0fdc0f5d62979f9c12557444f58e635b990e4ef789c2214c.exe	29
PID 1860 wrote to memory of 912	1860	9aa8e3d4a16d4cea0fdc0f5d62979f9c12557444f58e635b990e4ef789c2214c.exe	29

C:\Users\Admin\AppData\Local\Temp\9aa8e3d4a16d4cea0fdc0f5d62979f9c12557444f58e635b990e4ef789c2214c.exe
"C:\Users\Admin\AppData\Local\Temp\9aa8e3d4a16d4cea0fdc0f5d62979f9c12557444f58e635b990e4ef789c2214c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 52
  2⤵
  - Program crash
  PID:912

memory/1860-55-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download