0dd0c3082323a331ad2d5d36f5f7f3ac11826772077df7462da3229525d97862

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
29-09-2023 08:46

Target

9336e1b94359080686ac7d96212cd60c.exe
Size

458KB
MD5

9336e1b94359080686ac7d96212cd60c
SHA1

8cccdb6b4fbd9eee8ba4fe398c32da41f160b6f3
SHA256

0dd0c3082323a331ad2d5d36f5f7f3ac11826772077df7462da3229525d97862
SHA512

5a3ccf855581e51a188eee350928dbb56293ba345490b188207101f0ddb4162b5ca0eae12d0a65aedb6255be9e989c25d33d25a21a2d238b064892af24563ba1
SSDEEP

6144:Rk5+kbkZJ0aU7BfOp+1nRReEgNac8E9baVa0+f9g819Ri9WFYop10:Rk5Zki1pPOocCVax919RaW+w2

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2232 1260 WerFault.exe 9336e1b94359080686ac7d96212cd60c.exe

pid	pid_target	process	target process
2232	1260	WerFault.exe	9336e1b94359080686ac7d96212cd60c.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

9336e1b94359080686ac7d96212cd60c.exe

description	pid	process	target process
PID 1260 wrote to memory of 2288	1260	9336e1b94359080686ac7d96212cd60c.exe	RegAsm.exe
PID 1260 wrote to memory of 2288	1260	9336e1b94359080686ac7d96212cd60c.exe	RegAsm.exe
PID 1260 wrote to memory of 2288	1260	9336e1b94359080686ac7d96212cd60c.exe	RegAsm.exe
PID 1260 wrote to memory of 2288	1260	9336e1b94359080686ac7d96212cd60c.exe	RegAsm.exe
PID 1260 wrote to memory of 2288	1260	9336e1b94359080686ac7d96212cd60c.exe	RegAsm.exe
PID 1260 wrote to memory of 2288	1260	9336e1b94359080686ac7d96212cd60c.exe	RegAsm.exe
PID 1260 wrote to memory of 2288	1260	9336e1b94359080686ac7d96212cd60c.exe	RegAsm.exe
PID 1260 wrote to memory of 2232	1260	9336e1b94359080686ac7d96212cd60c.exe	WerFault.exe
PID 1260 wrote to memory of 2232	1260	9336e1b94359080686ac7d96212cd60c.exe	WerFault.exe
PID 1260 wrote to memory of 2232	1260	9336e1b94359080686ac7d96212cd60c.exe	WerFault.exe
PID 1260 wrote to memory of 2232	1260	9336e1b94359080686ac7d96212cd60c.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9336e1b94359080686ac7d96212cd60c.exe
"C:\Users\Admin\AppData\Local\Temp\9336e1b94359080686ac7d96212cd60c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 584
2⤵
- Program crash
PID:2232

memory/1260-0-0x0000000000290000-0x0000000000308000-memory.dmp

Filesize
480KB

Download
memory/1260-1-0x0000000074880000-0x0000000074F6E000-memory.dmp

Filesize
6.9MB

Download
memory/1260-2-0x0000000000260000-0x0000000000296000-memory.dmp

Filesize
216KB

Download
memory/1260-3-0x0000000004D80000-0x0000000004DC0000-memory.dmp

Filesize
256KB

Download
memory/1260-4-0x00000000001F0000-0x00000000001FA000-memory.dmp

Filesize
40KB

Download
memory/1260-5-0x0000000074880000-0x0000000074F6E000-memory.dmp

Filesize
6.9MB

Download
memory/1260-6-0x0000000004D80000-0x0000000004DC0000-memory.dmp

Filesize
256KB

Download