e9c79d17cd0c4ae4885a5cca57eac4972ca6ff659a6372ad22b4d712892f9429

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 10:04

Target

e9c79d17cd0c4ae4885a5cca57eac4972ca6ff659a6372ad22b4d712892f9429.exe
Size

6KB
MD5

af7e646911cfc3dc97ea1e2056e795bc
SHA1

1aee0c1293dfa616e6c67693d93ef0c34e2b14cb
SHA256

e9c79d17cd0c4ae4885a5cca57eac4972ca6ff659a6372ad22b4d712892f9429
SHA512

623f46d28e0febfe24b31fbf93b210441181b71323e20708c14e5596e770399f35ea759d94a51ecff8558df4f53813404ac200bbc3a717f298729c0a9701f2b4
SSDEEP

48:Sibt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9uaO:z0mIGnFc/38+N4ZHJWSY9FI5WqLx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1196	1288	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 1196	1288	e9c79d17cd0c4ae4885a5cca57eac4972ca6ff659a6372ad22b4d712892f9429.exe	27
PID 1288 wrote to memory of 1196	1288	e9c79d17cd0c4ae4885a5cca57eac4972ca6ff659a6372ad22b4d712892f9429.exe	27
PID 1288 wrote to memory of 1196	1288	e9c79d17cd0c4ae4885a5cca57eac4972ca6ff659a6372ad22b4d712892f9429.exe	27

C:\Users\Admin\AppData\Local\Temp\e9c79d17cd0c4ae4885a5cca57eac4972ca6ff659a6372ad22b4d712892f9429.exe
"C:\Users\Admin\AppData\Local\Temp\e9c79d17cd0c4ae4885a5cca57eac4972ca6ff659a6372ad22b4d712892f9429.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1288 -s 32
  2⤵
  - Program crash
  PID:1196