9687b1d916325973e61fe232937f79b053a91503c29fc45a06635bdbe2a4e172

Analysis

max time kernel
43s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 20:50

Target

9687b1d916325973e61fe232937f79b053a91503c29fc45a06635bdbe2a4e172.exe
Size

1.1MB
MD5

d13641e74256360661becf46bd2c48b1
SHA1

0f9e0bd9f60d0012644557cfc6e4dbfc49996d9d
SHA256

9687b1d916325973e61fe232937f79b053a91503c29fc45a06635bdbe2a4e172
SHA512

cce6ecf20e85f431910e2fca87965b79299554b9c45e1de88b4c50a3646c307bb642e67378fb9421635d1ed895ee7a7df213109354950d22a25d58e32671b63d
SSDEEP

24576:gpzTt4/yZVXpGxnFYjbwXWCWfOd+jbKuwDffQn4B:yvRVXUvYjb3CoOdmh4B

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1272	1208	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1272	1208	9687b1d916325973e61fe232937f79b053a91503c29fc45a06635bdbe2a4e172.exe	27
PID 1208 wrote to memory of 1272	1208	9687b1d916325973e61fe232937f79b053a91503c29fc45a06635bdbe2a4e172.exe	27
PID 1208 wrote to memory of 1272	1208	9687b1d916325973e61fe232937f79b053a91503c29fc45a06635bdbe2a4e172.exe	27
PID 1208 wrote to memory of 1272	1208	9687b1d916325973e61fe232937f79b053a91503c29fc45a06635bdbe2a4e172.exe	27

C:\Users\Admin\AppData\Local\Temp\9687b1d916325973e61fe232937f79b053a91503c29fc45a06635bdbe2a4e172.exe
"C:\Users\Admin\AppData\Local\Temp\9687b1d916325973e61fe232937f79b053a91503c29fc45a06635bdbe2a4e172.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 140
  2⤵
  - Program crash
  PID:1272

memory/1208-54-0x00000000759C1000-0x00000000759C3000-memory.dmp

Filesize
8KB

Download
memory/1208-55-0x0000000000400000-0x00000000006CB000-memory.dmp

Filesize
2.8MB

Download