9108e1d22d74bc5397b8886edc4f0a84b8906436a648ef8a86f30cf7e08978dd

Analysis

max time kernel
24s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-01-2023 00:16

Target

ZoomInstallerFull.exe
Size

76.4MB
MD5

aeb04e767a408e5ac643cd467751afff
SHA1

cc2b84718bcec1fe34b3e9189762149f4a91fc23
SHA256

9108e1d22d74bc5397b8886edc4f0a84b8906436a648ef8a86f30cf7e08978dd
SHA512

d7e4e4c523290ac5afec1382c275dacc8a1657d7a75c2298c3bbf1fe7881253a3b5005895b72954f5062f6cd25a52df6f72c4d0022335f2349c6ede2d0e66114
SSDEEP

1572864:jpDrQefrQSB+gTC4GB3RA9MLhWG7VYlSGTbANByfGajuTgIrPJGsF:9DLfrQQ/FA3RAicfUjByfFIDJ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1528 1532 WerFault.exe ZoomInstallerFull.exe

pid	pid_target	process	target process
1528	1532	WerFault.exe	ZoomInstallerFull.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ZoomInstallerFull.exe

description	pid	process	target process
PID 1532 wrote to memory of 1528	1532	ZoomInstallerFull.exe	WerFault.exe
PID 1532 wrote to memory of 1528	1532	ZoomInstallerFull.exe	WerFault.exe
PID 1532 wrote to memory of 1528	1532	ZoomInstallerFull.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ZoomInstallerFull.exe
"C:\Users\Admin\AppData\Local\Temp\ZoomInstallerFull.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1532

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1532 -s 40
2⤵
- Program crash
PID:1528