9e41cfc0982f5b467ce59e8fe10d40bdbbcafcf188bedeac1152cc976e7be755

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12-01-2023 19:32

Target

139ea7d22e38a9f4894f06dcb5286aa42de41297.exe
Size

52KB
MD5

84fd7094e873bdda344332401b76dfa9
SHA1

139ea7d22e38a9f4894f06dcb5286aa42de41297
SHA256

9e41cfc0982f5b467ce59e8fe10d40bdbbcafcf188bedeac1152cc976e7be755
SHA512

ef4eec540a54a54aa0e8ac3fba0e9d800d35b542389713b1651d80fc4ca541860c9bdaf9d2ace488f8ca4d542230cd57300f067240aa3bc4417a88f28be53342
SSDEEP

768:OC4hVOuFRRsuMwDzhuzSfUMtZIUSbY0EEgY2iV/UPHNKyWNe63cSHIdk:KzRpMwDzhpLfi+hdSoO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
896	856	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 896	856	139ea7d22e38a9f4894f06dcb5286aa42de41297.exe	27
PID 856 wrote to memory of 896	856	139ea7d22e38a9f4894f06dcb5286aa42de41297.exe	27
PID 856 wrote to memory of 896	856	139ea7d22e38a9f4894f06dcb5286aa42de41297.exe	27
PID 856 wrote to memory of 896	856	139ea7d22e38a9f4894f06dcb5286aa42de41297.exe	27

C:\Users\Admin\AppData\Local\Temp\139ea7d22e38a9f4894f06dcb5286aa42de41297.exe
"C:\Users\Admin\AppData\Local\Temp\139ea7d22e38a9f4894f06dcb5286aa42de41297.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 176
  2⤵
  - Program crash
  PID:896