9ed59cb3e20abbb81595aaad5ef89e6d71fab6285692488396fd46f863dfd998

Analysis

max time kernel
242s
max time network
337s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 08:49

Target

9ed59cb3e20abbb81595aaad5ef89e6d71fab6285692488396fd46f863dfd998.exe
Size

56KB
MD5

116bb921c62952c2cc130face3212c80
SHA1

daa014369178eec8cd71d7412f79f0a025cf80fa
SHA256

9ed59cb3e20abbb81595aaad5ef89e6d71fab6285692488396fd46f863dfd998
SHA512

9839706d85663c8d4529b95a06f6cbaa5f650f818f88164a1dfd878a9672542ee636f3b3352af82e8dc703fddffb64cbfb6be6684ff9e178de21a6ee51ce0dc6
SSDEEP

768:l9Q+Cf32/UzRFu0tDNjobGb0ZmT0j8oFzIlELZHd2u5PodT5LZVna6lndt9e3E9Y:4+8FoKtoVTtHEyoN5LZVawd+E9+btv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
516	540	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 516	540	9ed59cb3e20abbb81595aaad5ef89e6d71fab6285692488396fd46f863dfd998.exe	28
PID 540 wrote to memory of 516	540	9ed59cb3e20abbb81595aaad5ef89e6d71fab6285692488396fd46f863dfd998.exe	28
PID 540 wrote to memory of 516	540	9ed59cb3e20abbb81595aaad5ef89e6d71fab6285692488396fd46f863dfd998.exe	28
PID 540 wrote to memory of 516	540	9ed59cb3e20abbb81595aaad5ef89e6d71fab6285692488396fd46f863dfd998.exe	28

C:\Users\Admin\AppData\Local\Temp\9ed59cb3e20abbb81595aaad5ef89e6d71fab6285692488396fd46f863dfd998.exe
"C:\Users\Admin\AppData\Local\Temp\9ed59cb3e20abbb81595aaad5ef89e6d71fab6285692488396fd46f863dfd998.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 36
  2⤵
  - Program crash
  PID:516

memory/540-55-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download