9eefd4b84dbcdc7f47bb3c337d71af1180cfff1e7e081cee50c4b20c81aaf2ac

Analysis

max time kernel
46s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 06:29

Target

9eefd4b84dbcdc7f47bb3c337d71af1180cfff1e7e081cee50c4b20c81aaf2ac.exe
Size

124KB
MD5

e296c405e2b278c7a6265c33c92b8dd7
SHA1

8c3de31c2fb49d09d04552ee47f6ef000028915f
SHA256

9eefd4b84dbcdc7f47bb3c337d71af1180cfff1e7e081cee50c4b20c81aaf2ac
SHA512

f0f6d73216408a0269f7479cfb3b06d6d6cd9bdde14baad2e38af7f402ba1c634a45d79b01560be41d101aff4c5035b9df7f561c19fc50c24b94f46638cf3200
SSDEEP

1536:NqjzPQH4DNe+FPJ3SOIlYv4yzFqk/FVql7p8pBi1tCzkn2YchZtK0IsuM1i75:NmzC4w+FPJiOt7/jGgBa9ytK0EM1i7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
628	960	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 628	960	9eefd4b84dbcdc7f47bb3c337d71af1180cfff1e7e081cee50c4b20c81aaf2ac.exe	27
PID 960 wrote to memory of 628	960	9eefd4b84dbcdc7f47bb3c337d71af1180cfff1e7e081cee50c4b20c81aaf2ac.exe	27
PID 960 wrote to memory of 628	960	9eefd4b84dbcdc7f47bb3c337d71af1180cfff1e7e081cee50c4b20c81aaf2ac.exe	27
PID 960 wrote to memory of 628	960	9eefd4b84dbcdc7f47bb3c337d71af1180cfff1e7e081cee50c4b20c81aaf2ac.exe	27

C:\Users\Admin\AppData\Local\Temp\9eefd4b84dbcdc7f47bb3c337d71af1180cfff1e7e081cee50c4b20c81aaf2ac.exe
"C:\Users\Admin\AppData\Local\Temp\9eefd4b84dbcdc7f47bb3c337d71af1180cfff1e7e081cee50c4b20c81aaf2ac.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 36
  2⤵
  - Program crash
  PID:628

memory/960-55-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download