c15c7e69d90fd076c43a89bb11cf2a642bf3e354566aeecfb9b58fee4e27372a

Analysis

max time kernel
20s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-12-2022 13:35

Target

ZoomInstallerFull.exe
Size

75.4MB
MD5

3d36e5c4caa98515b4cbede14c253676
SHA1

d2e1bd8ee0a2185557e5c01883cdccb53772f7bb
SHA256

c15c7e69d90fd076c43a89bb11cf2a642bf3e354566aeecfb9b58fee4e27372a
SHA512

b234812ba40bfee5dfacacf4d2198949d3636449e34a9f75c062d2bc20c6225edb1c4d25f737c5ecc0d31b1cbbf2960e3ba8ce97f006368871dda2a5cd2e6182
SSDEEP

1572864:upDrQefrQSB+gTC4GB3RA9MLhWG7VYlSGTbANByfGajuTgIrPJGs:cDLfrQQ/FA3RAicfUjByfFIDJ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1580 1928 WerFault.exe ZoomInstallerFull.exe

pid	pid_target	process	target process
1580	1928	WerFault.exe	ZoomInstallerFull.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ZoomInstallerFull.exe

description	pid	process	target process
PID 1928 wrote to memory of 1580	1928	ZoomInstallerFull.exe	WerFault.exe
PID 1928 wrote to memory of 1580	1928	ZoomInstallerFull.exe	WerFault.exe
PID 1928 wrote to memory of 1580	1928	ZoomInstallerFull.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ZoomInstallerFull.exe
"C:\Users\Admin\AppData\Local\Temp\ZoomInstallerFull.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1928 -s 40
2⤵
- Program crash
PID:1580