9e514ec9129eb2631e9fa66168452095f10cd1b03e0b7fbeddd7b8f56679129e

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 05:16

Target

9e514ec9129eb2631e9fa66168452095f10cd1b03e0b7fbeddd7b8f56679129e.exe
Size

1.6MB
MD5

6beab3ba15c0da3f8e9078c64e170662
SHA1

b815b2f8039ee5326154b3c60c5fb0cc1aab3f74
SHA256

9e514ec9129eb2631e9fa66168452095f10cd1b03e0b7fbeddd7b8f56679129e
SHA512

e5c19dbd0f7e753b0625d193d7fa3ed6651d2ea0e99676d04471ec369576199835bd7c92a63f4814a9190944d1b6b2c37b9755e7ff58c8852178cf064a6f1210
SSDEEP

12288:WJbtlAI/1IFfmtFqeJa3hIAv0YCv1cEnc+GeQnSGJOoSa50tV0a0xLahfVDRl:WCYGfmtFbY3CAvFENrQWaugIDR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2140	1064	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 2140	1064	9e514ec9129eb2631e9fa66168452095f10cd1b03e0b7fbeddd7b8f56679129e.exe	28
PID 1064 wrote to memory of 2140	1064	9e514ec9129eb2631e9fa66168452095f10cd1b03e0b7fbeddd7b8f56679129e.exe	28
PID 1064 wrote to memory of 2140	1064	9e514ec9129eb2631e9fa66168452095f10cd1b03e0b7fbeddd7b8f56679129e.exe	28
PID 1064 wrote to memory of 2140	1064	9e514ec9129eb2631e9fa66168452095f10cd1b03e0b7fbeddd7b8f56679129e.exe	28

C:\Users\Admin\AppData\Local\Temp\9e514ec9129eb2631e9fa66168452095f10cd1b03e0b7fbeddd7b8f56679129e.exe
"C:\Users\Admin\AppData\Local\Temp\9e514ec9129eb2631e9fa66168452095f10cd1b03e0b7fbeddd7b8f56679129e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 36
  2⤵
  - Program crash
  PID:2140

memory/1064-0-0x0000000000400000-0x00000000006C9000-memory.dmp

Filesize
2.8MB

Download