9632eb08cd903f42da2bea520956cafce454abe7c34d84b5e358d8407f74303c

Analysis

max time kernel
44s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/12/2022, 03:25

Target

9632eb08cd903f42da2bea520956cafce454abe7c34d84b5e358d8407f74303c.exe
Size

134KB
MD5

223aef1a974f1265a1fadf53d19755c7
SHA1

9a4771fbd36d44f4c8027316558bc9d0f266c2d3
SHA256

9632eb08cd903f42da2bea520956cafce454abe7c34d84b5e358d8407f74303c
SHA512

b0dbed0959c4cc043be9662c6b1d3740daefa52abb34242b61da5bb8c2fb3b25c0b9744a08a509ade75cb975fccb8649308a2f0d4483642b203ddb22f4338d54
SSDEEP

3072:r8oxAiwqH6AY0TS9WJZqFvVwMXnBU0CahYOIUm4:rXk4RnqFv/e0dYBUt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1352	1324	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1352	1324	9632eb08cd903f42da2bea520956cafce454abe7c34d84b5e358d8407f74303c.exe	27
PID 1324 wrote to memory of 1352	1324	9632eb08cd903f42da2bea520956cafce454abe7c34d84b5e358d8407f74303c.exe	27
PID 1324 wrote to memory of 1352	1324	9632eb08cd903f42da2bea520956cafce454abe7c34d84b5e358d8407f74303c.exe	27
PID 1324 wrote to memory of 1352	1324	9632eb08cd903f42da2bea520956cafce454abe7c34d84b5e358d8407f74303c.exe	27

C:\Users\Admin\AppData\Local\Temp\9632eb08cd903f42da2bea520956cafce454abe7c34d84b5e358d8407f74303c.exe
"C:\Users\Admin\AppData\Local\Temp\9632eb08cd903f42da2bea520956cafce454abe7c34d84b5e358d8407f74303c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 88
  2⤵
  - Program crash
  PID:1352