cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
27-02-2023 01:37

Target

9ec8468dd4a81b0b35c499b31e67375e.exe
Size

624KB
MD5

9ec8468dd4a81b0b35c499b31e67375e
SHA1

6fa04992c0624c7aa3ca80da6a30e6de91226a16
SHA256

cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327
SHA512

bd6b37a0395f0ae508c54dcb62d5258adfb8c202605db8310c6b8758c3874bd2364491b1b129209ba1854df27f35149f891ac785a89fe26ddc45c40cad8023b2
SSDEEP

12288:CpCB9AVqhPDUHvOdO21ai1m2Y+o1mQR5LaVfnkBUxarLIN8Wah5/wodPdv7PVTFe:Cp12UPQkBUO/B5/lzTVTFH+

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1500 1704 WerFault.exe 9ec8468dd4a81b0b35c499b31e67375e.exe

pid	pid_target	process	target process
1500	1704	WerFault.exe	9ec8468dd4a81b0b35c499b31e67375e.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

9ec8468dd4a81b0b35c499b31e67375e.exe

description	pid	process	target process
PID 1704 wrote to memory of 1500	1704	9ec8468dd4a81b0b35c499b31e67375e.exe	WerFault.exe
PID 1704 wrote to memory of 1500	1704	9ec8468dd4a81b0b35c499b31e67375e.exe	WerFault.exe
PID 1704 wrote to memory of 1500	1704	9ec8468dd4a81b0b35c499b31e67375e.exe	WerFault.exe
PID 1704 wrote to memory of 1500	1704	9ec8468dd4a81b0b35c499b31e67375e.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9ec8468dd4a81b0b35c499b31e67375e.exe
"C:\Users\Admin\AppData\Local\Temp\9ec8468dd4a81b0b35c499b31e67375e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 156
  2⤵
  - Program crash
  PID:1500