9509b28159d518eb7b539a978a1ce34f9cd64411206074b885310796fbc855b1

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 01:02

Target

9509b28159d518eb7b539a978a1ce34f9cd64411206074b885310796fbc855b1.exe
Size

11.0MB
MD5

4175f73f1f6cb8be9f6a1c8f6a69e895
SHA1

462ff81b40c77cae2c709bbad2bddc9ae10b3ac9
SHA256

9509b28159d518eb7b539a978a1ce34f9cd64411206074b885310796fbc855b1
SHA512

c7118aa82feb3b27d7377e9479a56e6f78c9d7ef2c36c411c85ac4438b77d0caa24d77b78e7482fe49902029cba96147b2bc5cdcbdd3cfad98a658827c02b476
SSDEEP

98304:03H/z5ain1OgG+MMTCRS6vKeokBlOOTow:03H7Yi1OgGe8iVkBxow

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1680	3036	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 1680	3036	9509b28159d518eb7b539a978a1ce34f9cd64411206074b885310796fbc855b1.exe	19
PID 3036 wrote to memory of 1680	3036	9509b28159d518eb7b539a978a1ce34f9cd64411206074b885310796fbc855b1.exe	19
PID 3036 wrote to memory of 1680	3036	9509b28159d518eb7b539a978a1ce34f9cd64411206074b885310796fbc855b1.exe	19
PID 3036 wrote to memory of 1680	3036	9509b28159d518eb7b539a978a1ce34f9cd64411206074b885310796fbc855b1.exe	19

C:\Users\Admin\AppData\Local\Temp\9509b28159d518eb7b539a978a1ce34f9cd64411206074b885310796fbc855b1.exe
"C:\Users\Admin\AppData\Local\Temp\9509b28159d518eb7b539a978a1ce34f9cd64411206074b885310796fbc855b1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 548
  2⤵
  - Program crash
  PID:1680

memory/3036-1-0x0000000010C20000-0x0000000011722000-memory.dmp

Filesize
11.0MB

Download
memory/3036-0-0x0000000074B50000-0x000000007523E000-memory.dmp

Filesize
6.9MB

Download
memory/3036-2-0x0000000074B50000-0x000000007523E000-memory.dmp

Filesize
6.9MB

Download