b9dd545087e4d9fd93f76d761e12c416dd52a85beca4b6fe7d66cb8b40f33056

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19-08-2023 12:40

Target

b9dd545087e4d9fd93f76d761e12c416dd52a85beca4b6fe7d66cb8b40f33056.exe
Size

4.2MB
MD5

d44dfcb61943a647ef3433a21ef22bae
SHA1

a1dbf1fd5c706092912fc17b7232a754c4dcfd03
SHA256

b9dd545087e4d9fd93f76d761e12c416dd52a85beca4b6fe7d66cb8b40f33056
SHA512

66f7e1e592258ea780415880e4c02ce03299bcc6a5b5022df900f7bdaf32056d831391313456652f9c46d7277a6e72b724b137862e2eacab0e2031ba6f1622e0
SSDEEP

24576:4xP1Nmm3mdNjEOSjiR6x44cGHvFN4RTIZC9Bw:4bOIx4FlDw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1716	1976	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1716	1976	b9dd545087e4d9fd93f76d761e12c416dd52a85beca4b6fe7d66cb8b40f33056.exe	28
PID 1976 wrote to memory of 1716	1976	b9dd545087e4d9fd93f76d761e12c416dd52a85beca4b6fe7d66cb8b40f33056.exe	28
PID 1976 wrote to memory of 1716	1976	b9dd545087e4d9fd93f76d761e12c416dd52a85beca4b6fe7d66cb8b40f33056.exe	28
PID 1976 wrote to memory of 1716	1976	b9dd545087e4d9fd93f76d761e12c416dd52a85beca4b6fe7d66cb8b40f33056.exe	28

C:\Users\Admin\AppData\Local\Temp\b9dd545087e4d9fd93f76d761e12c416dd52a85beca4b6fe7d66cb8b40f33056.exe
"C:\Users\Admin\AppData\Local\Temp\b9dd545087e4d9fd93f76d761e12c416dd52a85beca4b6fe7d66cb8b40f33056.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 36
  2⤵
  - Program crash
  PID:1716

memory/1976-53-0x0000000000400000-0x0000000001DA1000-memory.dmp

Filesize
25.6MB

Download