9e831a6b952e488c0bc73d2c8b6dcdcbb79461756abb0b137cf03422bbcf958c

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
03/11/2023, 08:44

Target

9e831a6b952e488c0bc73d2c8b6dcdcbb79461756abb0b137cf03422bbcf958c.exe
Size

245KB
MD5

84e3160f473ab5f80684abc4af67b723
SHA1

1291b56240ad836d1087fe5cee61c5a8a64395ba
SHA256

9e831a6b952e488c0bc73d2c8b6dcdcbb79461756abb0b137cf03422bbcf958c
SHA512

0470bc7dcaa0be7d26c56f0c8a92c0f4505d10f265716a7b6103459e9dae3e1bff7375dedcb20d2304e7f7348f78760a1c950cf430eabe0ec7fe253ae4fa5ef7
SSDEEP

3072:q747R4nQJYRw1YhWLN1y3JngMnSPGx3MZ9W5acf/FJYRw1Tg:+4nuRw1Yh6N6JgExcZeVuRw1k

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1420	2040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1420	2040	9e831a6b952e488c0bc73d2c8b6dcdcbb79461756abb0b137cf03422bbcf958c.exe	28
PID 2040 wrote to memory of 1420	2040	9e831a6b952e488c0bc73d2c8b6dcdcbb79461756abb0b137cf03422bbcf958c.exe	28
PID 2040 wrote to memory of 1420	2040	9e831a6b952e488c0bc73d2c8b6dcdcbb79461756abb0b137cf03422bbcf958c.exe	28
PID 2040 wrote to memory of 1420	2040	9e831a6b952e488c0bc73d2c8b6dcdcbb79461756abb0b137cf03422bbcf958c.exe	28

C:\Users\Admin\AppData\Local\Temp\9e831a6b952e488c0bc73d2c8b6dcdcbb79461756abb0b137cf03422bbcf958c.exe
"C:\Users\Admin\AppData\Local\Temp\9e831a6b952e488c0bc73d2c8b6dcdcbb79461756abb0b137cf03422bbcf958c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 568
  2⤵
  - Program crash
  PID:1420

memory/2040-0-0x0000000000250000-0x0000000000292000-memory.dmp

Filesize
264KB

Download
memory/2040-1-0x0000000074520000-0x0000000074C0E000-memory.dmp

Filesize
6.9MB

Download
memory/2040-2-0x0000000074520000-0x0000000074C0E000-memory.dmp

Filesize
6.9MB

Download