9108e1d22d74bc5397b8886edc4f0a84b8906436a648ef8a86f30cf7e08978dd

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/01/2023, 05:38

Target
ZoomInstallerFull.exe
Size 76.4MB
Sample230103-gbv2psde21
SHA256 9108e1d22d74bc5397b8886edc4f0a84b8906436a648ef8a86f30cf7e08978dd
MD5 aeb04e767a408e5ac643cd467751afff
SHA1 cc2b84718bcec1fe34b3e9189762149f4a91fc23
SHA512 d7e4e4c523290ac5afec1382c275dacc8a1657d7a75c2298c3bbf1fe7881253a3b5005895b72954f5062f6cd25a52df6f72c4d0022335f2349c6ede2d0e66114
SSDEEP 1572864:jpDrQefrQSB+gTC4GB3RA9MLhWG7VYlSGTbANByfGajuTgIrPJGsF:9DLfrQQ/FA3RAicfUjByfFIDJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
912	368	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 912	368	ZoomInstallerFull.exe	28
PID 368 wrote to memory of 912	368	ZoomInstallerFull.exe	28
PID 368 wrote to memory of 912	368	ZoomInstallerFull.exe	28

C:\Users\Admin\AppData\Local\Temp\ZoomInstallerFull.exe
"C:\Users\Admin\AppData\Local\Temp\ZoomInstallerFull.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:368
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 368 -s 40
  2⤵
  - Program crash
  PID:912