b9c3761ad47ade7e7e1ce173ebbeb3b6e533eb146da8544d480930d5dc296248

Analysis

max time kernel
142s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 14:27

Target

b9c3761ad47ade7e7e1ce173ebbeb3b6e533eb146da8544d480930d5dc296248.exe
Size

236KB
MD5

b49cf832f68aba61b8983061b5fc2967
SHA1

d275de2d4ca85e6b6f39b8a28508d3fbf3819d19
SHA256

b9c3761ad47ade7e7e1ce173ebbeb3b6e533eb146da8544d480930d5dc296248
SHA512

5360331e6d7058bcbfb07988be4c75393b60ff42c29e7f8f8c9f5b706053380a095130eb753d1b4283d97bf79526d5cf7a5dea7b2d17bbfa4405112bc26277fd
SSDEEP

3072:QkblbLdo0DH+fKdp5Hy6a0z6qraWP5fSRo:tbLdo0DH+idp5S6a0O6PlF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2012	576	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 2012	576	b9c3761ad47ade7e7e1ce173ebbeb3b6e533eb146da8544d480930d5dc296248.exe	26
PID 576 wrote to memory of 2012	576	b9c3761ad47ade7e7e1ce173ebbeb3b6e533eb146da8544d480930d5dc296248.exe	26
PID 576 wrote to memory of 2012	576	b9c3761ad47ade7e7e1ce173ebbeb3b6e533eb146da8544d480930d5dc296248.exe	26
PID 576 wrote to memory of 2012	576	b9c3761ad47ade7e7e1ce173ebbeb3b6e533eb146da8544d480930d5dc296248.exe	26

C:\Users\Admin\AppData\Local\Temp\b9c3761ad47ade7e7e1ce173ebbeb3b6e533eb146da8544d480930d5dc296248.exe
"C:\Users\Admin\AppData\Local\Temp\b9c3761ad47ade7e7e1ce173ebbeb3b6e533eb146da8544d480930d5dc296248.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 140
  2⤵
  - Program crash
  PID:2012

memory/576-54-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/576-55-0x0000000075911000-0x0000000075913000-memory.dmp

Filesize
8KB

Download
memory/576-57-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download