9ae9f408c07868b0b4b68053084271f6bd0ca73d6d36942d3ceb5ca8906995ff

Analysis

max time kernel
40s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 11:21

Target

9ae9f408c07868b0b4b68053084271f6bd0ca73d6d36942d3ceb5ca8906995ff.exe
Size

58KB
MD5

3d508355bbc18110459a36c73aba1aef
SHA1

0c2aa33171f2efa4a44933b71768c49e66a78f25
SHA256

9ae9f408c07868b0b4b68053084271f6bd0ca73d6d36942d3ceb5ca8906995ff
SHA512

950bb977e09def86c3ac0851de934c7e8d2a52a9f64f6a3b6dbe91a84ede4f0f41684a4bd18f6b4db7b7bd59d741a25933a81ef961a1c6a7ceb8e9bb9fb905c6
SSDEEP

768:O9/VMOZsk8M81/1epku7WtXSN9+8ILhS0cVr/+U+IDrQse1plPPm6yVrrGAuaQSn:SSfk1i1o5DIEDr+seRPmzMNBSAvVyKfw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
928	992	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 928	992	9ae9f408c07868b0b4b68053084271f6bd0ca73d6d36942d3ceb5ca8906995ff.exe	27
PID 992 wrote to memory of 928	992	9ae9f408c07868b0b4b68053084271f6bd0ca73d6d36942d3ceb5ca8906995ff.exe	27
PID 992 wrote to memory of 928	992	9ae9f408c07868b0b4b68053084271f6bd0ca73d6d36942d3ceb5ca8906995ff.exe	27
PID 992 wrote to memory of 928	992	9ae9f408c07868b0b4b68053084271f6bd0ca73d6d36942d3ceb5ca8906995ff.exe	27

C:\Users\Admin\AppData\Local\Temp\9ae9f408c07868b0b4b68053084271f6bd0ca73d6d36942d3ceb5ca8906995ff.exe
"C:\Users\Admin\AppData\Local\Temp\9ae9f408c07868b0b4b68053084271f6bd0ca73d6d36942d3ceb5ca8906995ff.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 88
  2⤵
  - Program crash
  PID:928

memory/992-55-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download