0955c680c8294c8909fc59dce188ff45fdbbf094eccc865233e9039a003cfba2

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
01-10-2023 04:20

Target

0955c680c8294c8909fc59dce188ff45fdbbf094eccc865233e9039a003cfba2.exe
Size

4.6MB
MD5

14e76f6f49212fc080f86a3acc19599e
SHA1

ff4e6ab8b1b1bdd48d0ee633c6c5cc3c5d6816d8
SHA256

0955c680c8294c8909fc59dce188ff45fdbbf094eccc865233e9039a003cfba2
SHA512

74bb864c1a469a120ad325e7acf2bf99bf6c194f17b9f8fbb261b9fd3129508b18d4f75e58f6165691cb2cd0100b6daf19f342465c7142a6303092c3a8ee65fb
SSDEEP

49152:vsxDYboly1VBP1g/r5viN0C24DJtGZXPwh11sXIAyT9tN939JEG+wINmva:vsx2oYf9u5viN0CRG9Ps1sByTwG+wINp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2912	3052	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2912	3052	0955c680c8294c8909fc59dce188ff45fdbbf094eccc865233e9039a003cfba2.exe	28
PID 3052 wrote to memory of 2912	3052	0955c680c8294c8909fc59dce188ff45fdbbf094eccc865233e9039a003cfba2.exe	28
PID 3052 wrote to memory of 2912	3052	0955c680c8294c8909fc59dce188ff45fdbbf094eccc865233e9039a003cfba2.exe	28
PID 3052 wrote to memory of 2912	3052	0955c680c8294c8909fc59dce188ff45fdbbf094eccc865233e9039a003cfba2.exe	28

C:\Users\Admin\AppData\Local\Temp\0955c680c8294c8909fc59dce188ff45fdbbf094eccc865233e9039a003cfba2.exe
"C:\Users\Admin\AppData\Local\Temp\0955c680c8294c8909fc59dce188ff45fdbbf094eccc865233e9039a003cfba2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 120
  2⤵
  - Program crash
  PID:2912

memory/3052-0-0x00000000008F0000-0x0000000000A28000-memory.dmp

Filesize
1.2MB

Download