9712ba934666736c1e554090545c26b20133b71f47e5a28eb3f4582e64f68efc

Analysis

max time kernel
6s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/12/2022, 03:19

Target

9712ba934666736c1e554090545c26b20133b71f47e5a28eb3f4582e64f68efc.exe
Size

35KB
MD5

7a741227a3aefea1ec29d9343543e7b0
SHA1

a9fc0f7e2288b8c07e3f31741f1719d509095cad
SHA256

9712ba934666736c1e554090545c26b20133b71f47e5a28eb3f4582e64f68efc
SHA512

93be8019863b1394a31675522c47ec48d371c692f5b7d16519dc85dc88752be6d869426a08c39750d8c5ca086c73bf32959c69cb870a884c3a6a3981e03a0c0b
SSDEEP

768:vugSNf6AtMQdWOK96A7ufONeg6ZqZGZjMjxho:vug8fMQdWOo7SC1jxho

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1600	1032	WerFault.exe	16

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1032	9712ba934666736c1e554090545c26b20133b71f47e5a28eb3f4582e64f68efc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 1600	1032	9712ba934666736c1e554090545c26b20133b71f47e5a28eb3f4582e64f68efc.exe	27
PID 1032 wrote to memory of 1600	1032	9712ba934666736c1e554090545c26b20133b71f47e5a28eb3f4582e64f68efc.exe	27
PID 1032 wrote to memory of 1600	1032	9712ba934666736c1e554090545c26b20133b71f47e5a28eb3f4582e64f68efc.exe	27
PID 1032 wrote to memory of 1600	1032	9712ba934666736c1e554090545c26b20133b71f47e5a28eb3f4582e64f68efc.exe	27

C:\Users\Admin\AppData\Local\Temp\9712ba934666736c1e554090545c26b20133b71f47e5a28eb3f4582e64f68efc.exe
"C:\Users\Admin\AppData\Local\Temp\9712ba934666736c1e554090545c26b20133b71f47e5a28eb3f4582e64f68efc.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 52
  2⤵
  - Program crash
  PID:1600

memory/1032-55-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download