9be3a12cd83cb8922d1b215c5a9a1c43c5f44b4c870132ff40e50e3b98398825

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19/09/2023, 08:01

Target

9be3a12cd83cb8922d1b215c5a9a1c43c5f44b4c870132ff40e50e3b98398825.exe
Size

5KB
MD5

e1068eb6ba61c73593245a6814c938fa
SHA1

f31a126fe79cc07ae407f57c7993127d5c906845
SHA256

9be3a12cd83cb8922d1b215c5a9a1c43c5f44b4c870132ff40e50e3b98398825
SHA512

9d83b4401948f59e9a37f53d528749dbab0c8cd7a5b07e13893b0be30ebf84b3120e1379393bc36368b3cd385f28bd9b58b788c0aec400b01ebd5a9be420e84e
SSDEEP

48:ShlXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7tzRuqSxp:yWLkFfNnOKYloIQ2pm2pbYShxE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3040	2524	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 3040	2524	9be3a12cd83cb8922d1b215c5a9a1c43c5f44b4c870132ff40e50e3b98398825.exe	28
PID 2524 wrote to memory of 3040	2524	9be3a12cd83cb8922d1b215c5a9a1c43c5f44b4c870132ff40e50e3b98398825.exe	28
PID 2524 wrote to memory of 3040	2524	9be3a12cd83cb8922d1b215c5a9a1c43c5f44b4c870132ff40e50e3b98398825.exe	28
PID 2524 wrote to memory of 3040	2524	9be3a12cd83cb8922d1b215c5a9a1c43c5f44b4c870132ff40e50e3b98398825.exe	28

C:\Users\Admin\AppData\Local\Temp\9be3a12cd83cb8922d1b215c5a9a1c43c5f44b4c870132ff40e50e3b98398825.exe
"C:\Users\Admin\AppData\Local\Temp\9be3a12cd83cb8922d1b215c5a9a1c43c5f44b4c870132ff40e50e3b98398825.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 48
  2⤵
  - Program crash
  PID:3040