9e6fe6768dbc3850bc115364195e3ef8f8d99e1325b75fe56d292bacfbc2c950

Analysis

max time kernel
3s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 06:31

Target

9e6fe6768dbc3850bc115364195e3ef8f8d99e1325b75fe56d292bacfbc2c950.exe
Size

60KB
MD5

5083203c585b62918c1e68e640a98d8c
SHA1

b1aebef2c0b2171c70d8921184adcac10f30c05a
SHA256

9e6fe6768dbc3850bc115364195e3ef8f8d99e1325b75fe56d292bacfbc2c950
SHA512

5a3d767cdafba146f7c56023ea1e6340082b13f43dd23ef4357dc81faa12b20d5beaa92a458379c2d2e0a388eb0e5e85b1fbcb36833e0c1d09fcfb97c5177de8
SSDEEP

768:8D1ODg0AtXfe2ow6kbPrPgUq4O8MJmeEYi/DDfZqU8t0tH9uyuZ/MZew/ig4RoS:8ssfoxaTPbVOPcfYU82tHEhw/Z4RoS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1968	1984	WerFault.exe	9

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1968	1984	9e6fe6768dbc3850bc115364195e3ef8f8d99e1325b75fe56d292bacfbc2c950.exe	28
PID 1984 wrote to memory of 1968	1984	9e6fe6768dbc3850bc115364195e3ef8f8d99e1325b75fe56d292bacfbc2c950.exe	28
PID 1984 wrote to memory of 1968	1984	9e6fe6768dbc3850bc115364195e3ef8f8d99e1325b75fe56d292bacfbc2c950.exe	28
PID 1984 wrote to memory of 1968	1984	9e6fe6768dbc3850bc115364195e3ef8f8d99e1325b75fe56d292bacfbc2c950.exe	28
PID 1984 wrote to memory of 1968	1984	9e6fe6768dbc3850bc115364195e3ef8f8d99e1325b75fe56d292bacfbc2c950.exe	28
PID 1984 wrote to memory of 1968	1984	9e6fe6768dbc3850bc115364195e3ef8f8d99e1325b75fe56d292bacfbc2c950.exe	28
PID 1984 wrote to memory of 1968	1984	9e6fe6768dbc3850bc115364195e3ef8f8d99e1325b75fe56d292bacfbc2c950.exe	28

C:\Users\Admin\AppData\Local\Temp\9e6fe6768dbc3850bc115364195e3ef8f8d99e1325b75fe56d292bacfbc2c950.exe
"C:\Users\Admin\AppData\Local\Temp\9e6fe6768dbc3850bc115364195e3ef8f8d99e1325b75fe56d292bacfbc2c950.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 256
  2⤵
  - Program crash
  PID:1968

memory/1984-54-0x0000000075761000-0x0000000075763000-memory.dmp

Filesize
8KB

Download
memory/1984-56-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download