9c41b48834ec40c38556506ccc5ef06566fe04b1b19ecbd45b172ee3c3ad3f33

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 01:06

Target
9c41b48834ec40c38556506ccc5ef06566fe04b1b19ecbd45b172ee3c3ad3f33.exe
Size 109KB
Sample231225-bf4azsfdgp
SHA256 9c41b48834ec40c38556506ccc5ef06566fe04b1b19ecbd45b172ee3c3ad3f33
MD5 3cfee1a67d046a1e4056f80ce3ac212c
SHA1 b1ba88646998ccb0409d4f869f1c09d6b12f2f05
SHA512 2b3170ef395695e2ab6da09d1f7bf9ad8bb0dcab168dfd0d0f06bac339b4f9af2cac655179cbaa28b55e3cde95dab917446bd4465ffff8089c492538cdd097ed
SSDEEP 1536:LvjAnXqn2nY7WfRMgPQQrM7qmyVttdGFQeOPig7:LLCan2nY7sdQQA7qmyBeI
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1724	1128	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 1724	1128	9c41b48834ec40c38556506ccc5ef06566fe04b1b19ecbd45b172ee3c3ad3f33.exe	18
PID 1128 wrote to memory of 1724	1128	9c41b48834ec40c38556506ccc5ef06566fe04b1b19ecbd45b172ee3c3ad3f33.exe	18
PID 1128 wrote to memory of 1724	1128	9c41b48834ec40c38556506ccc5ef06566fe04b1b19ecbd45b172ee3c3ad3f33.exe	18
PID 1128 wrote to memory of 1724	1128	9c41b48834ec40c38556506ccc5ef06566fe04b1b19ecbd45b172ee3c3ad3f33.exe	18

C:\Users\Admin\AppData\Local\Temp\9c41b48834ec40c38556506ccc5ef06566fe04b1b19ecbd45b172ee3c3ad3f33.exe
"C:\Users\Admin\AppData\Local\Temp\9c41b48834ec40c38556506ccc5ef06566fe04b1b19ecbd45b172ee3c3ad3f33.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 564
  2⤵
  - Program crash
  PID:1724

memory/1128-0-0x0000000001190000-0x00000000011B0000-memory.dmp

Download

memory/1128-1-0x0000000074B10000-0x00000000751FE000-memory.dmp

Download

memory/1128-2-0x0000000074B10000-0x00000000751FE000-memory.dmp

Download