3cd623dc27d6fbeab8c4df163b6c42e48786fa4c733c9054d8784499b02370a1

Analysis

max time kernel
27s
max time network
31s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
09/07/2023, 15:05

Target

9109a8f59d6a2dexeexeexeex.exe
Size

195KB
MD5

9109a8f59d6a2d2e64073890ff84aa73
SHA1

3fd67cd7809cc6995deb3cf974999ca39812a179
SHA256

3cd623dc27d6fbeab8c4df163b6c42e48786fa4c733c9054d8784499b02370a1
SHA512

cf5e91fb75b322d6f8d7b78818e0f0feea4687875e05d9fb7105dd13077428d4eb3ba39fd02514ef234052977674d5d8a70ef21cc6126c72b55b2eb8769a4b67
SSDEEP

3072:lDag6JfFkEtWk0EWNPLMqqDL2/phDMkcUrIwofej9Q7WWdE+FBaDmh8CohxBGERF:lDaTNiPoqqDL61Bvdp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2364	2196	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2364	2196	9109a8f59d6a2dexeexeexeex.exe	28
PID 2196 wrote to memory of 2364	2196	9109a8f59d6a2dexeexeexeex.exe	28
PID 2196 wrote to memory of 2364	2196	9109a8f59d6a2dexeexeexeex.exe	28
PID 2196 wrote to memory of 2364	2196	9109a8f59d6a2dexeexeexeex.exe	28

C:\Users\Admin\AppData\Local\Temp\9109a8f59d6a2dexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\9109a8f59d6a2dexeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 88
  2⤵
  - Program crash
  PID:2364