9fefbc9c3359514c5871805e91c97613dbf1614427e77214d85eed1a567e863d

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 21:39

Target

f9fea5855c37cb65ddaecce010e97200.exe
Size

24KB
MD5

f9fea5855c37cb65ddaecce010e97200
SHA1

5aa646de7cf405c99c609ec88176c8ff438095ac
SHA256

9fefbc9c3359514c5871805e91c97613dbf1614427e77214d85eed1a567e863d
SHA512

61917b240e22fe2cda1eebc3b69635c763269d33174cbb2d6803798be43e44744468cf71bd1cd5b48b036322562ca0b8f20ef1c8c1e1ddbc288908a0d9e24818
SSDEEP

192:80xy4AmxhB3pEAbc7QCwvk92wl6wgT88R39DvUoynA608cUu:8MHAahYz7hIEgT8Q9Dc+6dI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2376	2084	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2376	2084	f9fea5855c37cb65ddaecce010e97200.exe	28
PID 2084 wrote to memory of 2376	2084	f9fea5855c37cb65ddaecce010e97200.exe	28
PID 2084 wrote to memory of 2376	2084	f9fea5855c37cb65ddaecce010e97200.exe	28
PID 2084 wrote to memory of 2376	2084	f9fea5855c37cb65ddaecce010e97200.exe	28

C:\Users\Admin\AppData\Local\Temp\f9fea5855c37cb65ddaecce010e97200.exe
"C:\Users\Admin\AppData\Local\Temp\f9fea5855c37cb65ddaecce010e97200.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 160
  2⤵
  - Program crash
  PID:2376