ac9cb07f427405b499ca93e63cf70c4532bcf678fa3c5b10e580a317f29e2353

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 15:32

Target

ac9cb07f427405b499ca93e63cf70c4532bcf678fa3c5b10e580a317f29e2353.exe
Size

161KB
MD5

9b459be594b76cb785be394d9d647171
SHA1

00893d33de19173aa67d84d588afd9ad8493ee7e
SHA256

ac9cb07f427405b499ca93e63cf70c4532bcf678fa3c5b10e580a317f29e2353
SHA512

c2cf4fe64deba7e57cffed43c8b86b705b4c7095abe7d819a60d0c7d40a4a63f91f977a90e6c8d188132fcc38ca3450b6295f90c28f75b6f9a0227239924c346
SSDEEP

3072:b8Zc0hOH53F/y0nzTd6UjIWVvn+oT7V/f:/0qXzxHhv97Vn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1360	1972	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1360	1972	ac9cb07f427405b499ca93e63cf70c4532bcf678fa3c5b10e580a317f29e2353.exe	28
PID 1972 wrote to memory of 1360	1972	ac9cb07f427405b499ca93e63cf70c4532bcf678fa3c5b10e580a317f29e2353.exe	28
PID 1972 wrote to memory of 1360	1972	ac9cb07f427405b499ca93e63cf70c4532bcf678fa3c5b10e580a317f29e2353.exe	28
PID 1972 wrote to memory of 1360	1972	ac9cb07f427405b499ca93e63cf70c4532bcf678fa3c5b10e580a317f29e2353.exe	28

C:\Users\Admin\AppData\Local\Temp\ac9cb07f427405b499ca93e63cf70c4532bcf678fa3c5b10e580a317f29e2353.exe
"C:\Users\Admin\AppData\Local\Temp\ac9cb07f427405b499ca93e63cf70c4532bcf678fa3c5b10e580a317f29e2353.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 164
  2⤵
  - Program crash
  PID:1360

memory/1972-54-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/1972-56-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download