a21e1d563a5208c10394779abe962d8c620b9234ea00f0e11edbfa864462ae5e

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 03:11

Target

9a9b11421ba121e52cf3d40e59ccb330.exe
Size

89KB
MD5

9a9b11421ba121e52cf3d40e59ccb330
SHA1

2cfcf27f8a9bfbb138df8495d666240396a5f74a
SHA256

a21e1d563a5208c10394779abe962d8c620b9234ea00f0e11edbfa864462ae5e
SHA512

8bece51abc3e3985ce11950919d3328e780b0e4f74fa6da6f65b07b34624146d7b4f089a5f565123f48d983f3dfefb2cf4682b835b2322da5a4dcac7f931ed63
SSDEEP

1536:i1yhGafPgBQFRwoMbJT9AFWk+9EIegoY9eVDxxkgbU/j3:iwGafAoMbJTG/8EDgUVckU/j

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
856	1796	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 856	1796	9a9b11421ba121e52cf3d40e59ccb330.exe	28
PID 1796 wrote to memory of 856	1796	9a9b11421ba121e52cf3d40e59ccb330.exe	28
PID 1796 wrote to memory of 856	1796	9a9b11421ba121e52cf3d40e59ccb330.exe	28
PID 1796 wrote to memory of 856	1796	9a9b11421ba121e52cf3d40e59ccb330.exe	28

C:\Users\Admin\AppData\Local\Temp\9a9b11421ba121e52cf3d40e59ccb330.exe
"C:\Users\Admin\AppData\Local\Temp\9a9b11421ba121e52cf3d40e59ccb330.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 92
  2⤵
  - Program crash
  PID:856