0c9ad3756e89eca9349a4af3ecd78970efad36f7ae58bb24a9f2a2e633b3167b

Analysis

max time kernel
40s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 15:58

Target

0c9ad3756e89eca9349a4af3ecd78970efad36f7ae58bb24a9f2a2e633b3167b.exe
Size

50KB
MD5

0f7e43538e734f6e2c81b9888be6eff0
SHA1

d24032ea8800b41f0d236d68499ecb2f5112e11a
SHA256

0c9ad3756e89eca9349a4af3ecd78970efad36f7ae58bb24a9f2a2e633b3167b
SHA512

b62b56e3c0751eab8c4e499aab2f2569627f680279b3038811fdf6fc4a4acd7df9ba2a76d934f0f8f7b4ffecb40c05e3fa064ee91d648bd047b9c44661708eea
SSDEEP

768:3zx+iFA5+V12G3AXawxLhLzsxUTyvzZc2:39xFA5+V12oAX3XUyToz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1452	1892	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 1452	1892	0c9ad3756e89eca9349a4af3ecd78970efad36f7ae58bb24a9f2a2e633b3167b.exe	28
PID 1892 wrote to memory of 1452	1892	0c9ad3756e89eca9349a4af3ecd78970efad36f7ae58bb24a9f2a2e633b3167b.exe	28
PID 1892 wrote to memory of 1452	1892	0c9ad3756e89eca9349a4af3ecd78970efad36f7ae58bb24a9f2a2e633b3167b.exe	28
PID 1892 wrote to memory of 1452	1892	0c9ad3756e89eca9349a4af3ecd78970efad36f7ae58bb24a9f2a2e633b3167b.exe	28

C:\Users\Admin\AppData\Local\Temp\0c9ad3756e89eca9349a4af3ecd78970efad36f7ae58bb24a9f2a2e633b3167b.exe
"C:\Users\Admin\AppData\Local\Temp\0c9ad3756e89eca9349a4af3ecd78970efad36f7ae58bb24a9f2a2e633b3167b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 36
  2⤵
  - Program crash
  PID:1452