9503709bf2d2bf7043034b639fd72f7f4abcfbb5b58d2b36310925fa30e00785

Analysis

max time kernel
38s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 16:50

Target

9503709bf2d2bf7043034b639fd72f7f4abcfbb5b58d2b36310925fa30e00785.exe
Size

388KB
MD5

8ec50bcb6b12c6831df9e3e785354bbd
SHA1

b044b15fa839cc4517e5bb7089fb5350381dd19b
SHA256

9503709bf2d2bf7043034b639fd72f7f4abcfbb5b58d2b36310925fa30e00785
SHA512

1591343935bfee994e397872f1a81a9011ced86847138bedd7b126cc462d5bed0506f2a1e92b38f6258ad800b88a8626ad2b919e70c381578bda6b0e31d4d6f5
SSDEEP

3072:e2voeN+jaiG17Ef5KlrKnBZ59oZSmveDlcjIV8jlwIDU+V4EFFCcll3H3rH3XD7U:ZQeNai17Y56rKnBfWhveajzxwIDU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1148	1776	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1148	1776	9503709bf2d2bf7043034b639fd72f7f4abcfbb5b58d2b36310925fa30e00785.exe	28
PID 1776 wrote to memory of 1148	1776	9503709bf2d2bf7043034b639fd72f7f4abcfbb5b58d2b36310925fa30e00785.exe	28
PID 1776 wrote to memory of 1148	1776	9503709bf2d2bf7043034b639fd72f7f4abcfbb5b58d2b36310925fa30e00785.exe	28
PID 1776 wrote to memory of 1148	1776	9503709bf2d2bf7043034b639fd72f7f4abcfbb5b58d2b36310925fa30e00785.exe	28

C:\Users\Admin\AppData\Local\Temp\9503709bf2d2bf7043034b639fd72f7f4abcfbb5b58d2b36310925fa30e00785.exe
"C:\Users\Admin\AppData\Local\Temp\9503709bf2d2bf7043034b639fd72f7f4abcfbb5b58d2b36310925fa30e00785.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 100
  2⤵
  - Program crash
  PID:1148