9f164ff0d20dec6500c14c7834e7ac765c2f39280c6d11fdb8b37f4d1d5b2771

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-01-2024 19:32

Target

9f164ff0d20dec6500c14c7834e7ac765c2f39280c6d11fdb8b37f4d1d5b2771.exe
Size

5KB
MD5

f4558ee8b9e4390c3e93921841e30965
SHA1

279ec0d76cf4b5bb5f477e03249d9c985ac5dc24
SHA256

9f164ff0d20dec6500c14c7834e7ac765c2f39280c6d11fdb8b37f4d1d5b2771
SHA512

0a877bec1c71aacf14852e6b460b5debe78cfc15478b9d44c983f5a4fc0099821ce1962bc7fa75dc23de780d7732b9ad5cb8fa2841d9650cd5f58f8ce5e82ede
SSDEEP

48:S5lXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7twRuqSxp:WWLkFfNnOKYloIQ2pm2pbYScxE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2032	2936	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2032	2936	9f164ff0d20dec6500c14c7834e7ac765c2f39280c6d11fdb8b37f4d1d5b2771.exe	6
PID 2936 wrote to memory of 2032	2936	9f164ff0d20dec6500c14c7834e7ac765c2f39280c6d11fdb8b37f4d1d5b2771.exe	6
PID 2936 wrote to memory of 2032	2936	9f164ff0d20dec6500c14c7834e7ac765c2f39280c6d11fdb8b37f4d1d5b2771.exe	6
PID 2936 wrote to memory of 2032	2936	9f164ff0d20dec6500c14c7834e7ac765c2f39280c6d11fdb8b37f4d1d5b2771.exe	6

C:\Users\Admin\AppData\Local\Temp\9f164ff0d20dec6500c14c7834e7ac765c2f39280c6d11fdb8b37f4d1d5b2771.exe
"C:\Users\Admin\AppData\Local\Temp\9f164ff0d20dec6500c14c7834e7ac765c2f39280c6d11fdb8b37f4d1d5b2771.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 48
  2⤵
  - Program crash
  PID:2032