b9fce849adb5790654fbfcbab3be5d576f1bf95a4b9cd02d877e01fb607af92c

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07-12-2022 02:31

Target

b9fce849adb5790654fbfcbab3be5d576f1bf95a4b9cd02d877e01fb607af92c.exe
Size

214KB
MD5

65aef21728fe24bf07953deec8307cd9
SHA1

1cfdea1e4f5c8109deb40a9c9871bc508da5b57a
SHA256

b9fce849adb5790654fbfcbab3be5d576f1bf95a4b9cd02d877e01fb607af92c
SHA512

28d1323154db30aa9bfe1e4abcf8890e5c7d7a81fb55fbbeb924ae5d62575f887a430cca86c06e7a26e1bf4890c6cedc5fb197ba54057448d129d5a21b0e5848
SSDEEP

6144:/LAl4GuXktzXCp2PUkIoE/WxkkgLSJZjVDz/PnxR:DA+3MXSFlqFgLStz/PnL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
828	1200	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 828	1200	b9fce849adb5790654fbfcbab3be5d576f1bf95a4b9cd02d877e01fb607af92c.exe	27
PID 1200 wrote to memory of 828	1200	b9fce849adb5790654fbfcbab3be5d576f1bf95a4b9cd02d877e01fb607af92c.exe	27
PID 1200 wrote to memory of 828	1200	b9fce849adb5790654fbfcbab3be5d576f1bf95a4b9cd02d877e01fb607af92c.exe	27
PID 1200 wrote to memory of 828	1200	b9fce849adb5790654fbfcbab3be5d576f1bf95a4b9cd02d877e01fb607af92c.exe	27

C:\Users\Admin\AppData\Local\Temp\b9fce849adb5790654fbfcbab3be5d576f1bf95a4b9cd02d877e01fb607af92c.exe
"C:\Users\Admin\AppData\Local\Temp\b9fce849adb5790654fbfcbab3be5d576f1bf95a4b9cd02d877e01fb607af92c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 36
  2⤵
  - Program crash
  PID:828

memory/1200-55-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download