9108e1d22d74bc5397b8886edc4f0a84b8906436a648ef8a86f30cf7e08978dd

Analysis

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
09-01-2023 05:13

Target

ZoomInstallerFull.exe
Size

76.4MB
MD5

aeb04e767a408e5ac643cd467751afff
SHA1

cc2b84718bcec1fe34b3e9189762149f4a91fc23
SHA256

9108e1d22d74bc5397b8886edc4f0a84b8906436a648ef8a86f30cf7e08978dd
SHA512

d7e4e4c523290ac5afec1382c275dacc8a1657d7a75c2298c3bbf1fe7881253a3b5005895b72954f5062f6cd25a52df6f72c4d0022335f2349c6ede2d0e66114
SSDEEP

1572864:jpDrQefrQSB+gTC4GB3RA9MLhWG7VYlSGTbANByfGajuTgIrPJGsF:9DLfrQQ/FA3RAicfUjByfFIDJ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1756 2012 WerFault.exe ZoomInstallerFull.exe

pid	pid_target	process	target process
1756	2012	WerFault.exe	ZoomInstallerFull.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ZoomInstallerFull.exe

description	pid	process	target process
PID 2012 wrote to memory of 1756	2012	ZoomInstallerFull.exe	WerFault.exe
PID 2012 wrote to memory of 1756	2012	ZoomInstallerFull.exe	WerFault.exe
PID 2012 wrote to memory of 1756	2012	ZoomInstallerFull.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ZoomInstallerFull.exe
"C:\Users\Admin\AppData\Local\Temp\ZoomInstallerFull.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2012 -s 40
  2⤵
  - Program crash
  PID:1756