93d7262300c77b32148da609fac8441e734bfc80b85c46c62d9e2c6b6ec1a9cd

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15-02-2024 18:06

Target

9e36e59d7c5398d923dc49830a4ee0bd.exe
Size

784KB
MD5

9e36e59d7c5398d923dc49830a4ee0bd
SHA1

f4f4018fbbf38ed9b872d0cbda9d1e42ad9a675d
SHA256

93d7262300c77b32148da609fac8441e734bfc80b85c46c62d9e2c6b6ec1a9cd
SHA512

ab0a10fefa528985377c7da155345f845fdd962d99d592ace032cd96081acb4d4278fed22ee4b14f54ce3c6a346dba5623df3b5b1cb5dc2d869916a2111aaf53
SSDEEP

24576:GfPpjhVdCvxoT8sgtfdiKtA+/CYrRuQ9/l4Axc+m:GfPRhVdCvCT8sgCKtA9YrRHZ9m

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1276	2644	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 1276	2644	9e36e59d7c5398d923dc49830a4ee0bd.exe	28
PID 2644 wrote to memory of 1276	2644	9e36e59d7c5398d923dc49830a4ee0bd.exe	28
PID 2644 wrote to memory of 1276	2644	9e36e59d7c5398d923dc49830a4ee0bd.exe	28
PID 2644 wrote to memory of 1276	2644	9e36e59d7c5398d923dc49830a4ee0bd.exe	28

C:\Users\Admin\AppData\Local\Temp\9e36e59d7c5398d923dc49830a4ee0bd.exe
"C:\Users\Admin\AppData\Local\Temp\9e36e59d7c5398d923dc49830a4ee0bd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 148
  2⤵
  - Program crash
  PID:1276