9bed6439727af9616c7d04ad12a4b4f8adbbc60bc26ab93eda18c415efb63d98

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 08:56

Target

9bed6439727af9616c7d04ad12a4b4f8adbbc60bc26ab93eda18c415efb63d98.exe
Size

62KB
MD5

4b31781c3979c1a69a84162ef101a04c
SHA1

a03ffae449b00a41dc32c3a2ccf915fbbe868174
SHA256

9bed6439727af9616c7d04ad12a4b4f8adbbc60bc26ab93eda18c415efb63d98
SHA512

b28f88c1b6926e3ea5e4ca4366aeb6d998f3a001b534e1aedd699e8dd057d718e5c33b599dbd12c28b1898565ac89960eaf6e3d7f09f49a24f26621673f9a404
SSDEEP

1536:pYGBfdJBoOY4zW7T2yqrqDlRHhFRIZHxb:TfXU7sUlbXIl5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	1336	WerFault.exe	26

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 2040	1336	9bed6439727af9616c7d04ad12a4b4f8adbbc60bc26ab93eda18c415efb63d98.exe	28
PID 1336 wrote to memory of 2040	1336	9bed6439727af9616c7d04ad12a4b4f8adbbc60bc26ab93eda18c415efb63d98.exe	28
PID 1336 wrote to memory of 2040	1336	9bed6439727af9616c7d04ad12a4b4f8adbbc60bc26ab93eda18c415efb63d98.exe	28
PID 1336 wrote to memory of 2040	1336	9bed6439727af9616c7d04ad12a4b4f8adbbc60bc26ab93eda18c415efb63d98.exe	28
PID 1336 wrote to memory of 1708	1336	9bed6439727af9616c7d04ad12a4b4f8adbbc60bc26ab93eda18c415efb63d98.exe	30
PID 1336 wrote to memory of 1708	1336	9bed6439727af9616c7d04ad12a4b4f8adbbc60bc26ab93eda18c415efb63d98.exe	30
PID 1336 wrote to memory of 1708	1336	9bed6439727af9616c7d04ad12a4b4f8adbbc60bc26ab93eda18c415efb63d98.exe	30
PID 1336 wrote to memory of 1708	1336	9bed6439727af9616c7d04ad12a4b4f8adbbc60bc26ab93eda18c415efb63d98.exe	30

C:\Users\Admin\AppData\Local\Temp\9bed6439727af9616c7d04ad12a4b4f8adbbc60bc26ab93eda18c415efb63d98.exe
"C:\Users\Admin\AppData\Local\Temp\9bed6439727af9616c7d04ad12a4b4f8adbbc60bc26ab93eda18c415efb63d98.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\WINDOWS\SysWOW64\CMD.EXE
  C:\WINDOWS\SYSTEM32\CMD.EXE
  2⤵
  PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 52
  2⤵
  - Program crash
  PID:1708

memory/1336-56-0x00000000008F0000-0x0000000000903E34-memory.dmp

Filesize
79KB

Download