f9b69025468fc1580cce08e5ca60c393c4bb54672ec7d4b41e7f7307f9f530e4

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06-12-2023 03:23

Target

f9b69025468fc1580cce08e5ca60c393c4bb54672ec7d4b41e7f7307f9f530e4.exe
Size

2.7MB
MD5

e613b70a306bdbea67394a7bef850677
SHA1

1e044c9ccf43f9ed00b474d65ec6d70e4a863eb7
SHA256

f9b69025468fc1580cce08e5ca60c393c4bb54672ec7d4b41e7f7307f9f530e4
SHA512

33d70cf04219d8220f188f21711e3681f4ee093dce34e29814ed8d11c349a2c7519e7a5c2f9f5b690b3360f513fc22cafa424fe33abce4548c2c0dadba4a2a4f
SSDEEP

24576:Isn9+gS6uHk1U4cHPeT97o+hzy3cHoORwqetii6hsuiWHJKN8IEjSc:5LS6uH8UJGT9oHiohZ+G

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2184 1704 WerFault.exe f9b69025468fc1580cce08e5ca60c393c4bb54672ec7d4b41e7f7307f9f530e4.exe

pid	pid_target	process	target process
2184	1704	WerFault.exe	f9b69025468fc1580cce08e5ca60c393c4bb54672ec7d4b41e7f7307f9f530e4.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f9b69025468fc1580cce08e5ca60c393c4bb54672ec7d4b41e7f7307f9f530e4.exe

description	pid	process	target process
PID 1704 wrote to memory of 2184	1704	f9b69025468fc1580cce08e5ca60c393c4bb54672ec7d4b41e7f7307f9f530e4.exe	WerFault.exe
PID 1704 wrote to memory of 2184	1704	f9b69025468fc1580cce08e5ca60c393c4bb54672ec7d4b41e7f7307f9f530e4.exe	WerFault.exe
PID 1704 wrote to memory of 2184	1704	f9b69025468fc1580cce08e5ca60c393c4bb54672ec7d4b41e7f7307f9f530e4.exe	WerFault.exe
PID 1704 wrote to memory of 2184	1704	f9b69025468fc1580cce08e5ca60c393c4bb54672ec7d4b41e7f7307f9f530e4.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\f9b69025468fc1580cce08e5ca60c393c4bb54672ec7d4b41e7f7307f9f530e4.exe
"C:\Users\Admin\AppData\Local\Temp\f9b69025468fc1580cce08e5ca60c393c4bb54672ec7d4b41e7f7307f9f530e4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 548
2⤵
- Program crash
PID:2184

memory/1704-0-0x00000000000D0000-0x0000000000384000-memory.dmp

Filesize
2.7MB

Download
memory/1704-1-0x0000000074830000-0x0000000074F1E000-memory.dmp

Filesize
6.9MB

Download
memory/1704-2-0x0000000074830000-0x0000000074F1E000-memory.dmp

Filesize
6.9MB

Download