920ada9dbc98acfc32b56088cfc8efd3564bbcf8114c54d017d478de1d1e24a9

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15/10/2023, 08:01

Target

920ada9dbc98acfc32b56088cfc8efd3564bbcf8114c54d017d478de1d1e24a9.exe
Size

201KB
MD5

a3426533876cc8750115cb45f4d671e5
SHA1

98ec90d35b20d2f85c92abb7c3b9948afc00f8c8
SHA256

920ada9dbc98acfc32b56088cfc8efd3564bbcf8114c54d017d478de1d1e24a9
SHA512

14829c4368aae45baf9a5667d5efb256890c473e2e41826856defee27274b56d6f9ec3f806fa2dceca2824de502641b1e2594f5f6dfdf6cb1e4966d25f81a89a
SSDEEP

3072:ZgNpVWYxi/7gKNkhSC+t+MMCTs0kH+Bkx6uyXeKiB+N6LpCcu51lviIzdXfEqMl4:P7gKNkhSR/5kHouyXe9B+h8WH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	1704	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1708	1704	920ada9dbc98acfc32b56088cfc8efd3564bbcf8114c54d017d478de1d1e24a9.exe	28
PID 1704 wrote to memory of 1708	1704	920ada9dbc98acfc32b56088cfc8efd3564bbcf8114c54d017d478de1d1e24a9.exe	28
PID 1704 wrote to memory of 1708	1704	920ada9dbc98acfc32b56088cfc8efd3564bbcf8114c54d017d478de1d1e24a9.exe	28
PID 1704 wrote to memory of 1708	1704	920ada9dbc98acfc32b56088cfc8efd3564bbcf8114c54d017d478de1d1e24a9.exe	28

C:\Users\Admin\AppData\Local\Temp\920ada9dbc98acfc32b56088cfc8efd3564bbcf8114c54d017d478de1d1e24a9.exe
"C:\Users\Admin\AppData\Local\Temp\920ada9dbc98acfc32b56088cfc8efd3564bbcf8114c54d017d478de1d1e24a9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 124
  2⤵
  - Program crash
  PID:1708