9f45dd6ded444bb7af801b51d61285b4d1f5190e55556c0aadc680f7e547e63b

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
17-02-2024 01:19

Target

9f45dd6ded444bb7af801b51d61285b4d1f5190e55556c0aadc680f7e547e63b.exe
Size

2.7MB
MD5

2c39e7af5ae71bbae52f7a77cf14cdba
SHA1

9fa99b8de52fd51a9e3c154249a1f021d1e80f8b
SHA256

9f45dd6ded444bb7af801b51d61285b4d1f5190e55556c0aadc680f7e547e63b
SHA512

a87868b1b2d9ba3bf3258076fb6c8f995e6968902d59dfd0eb7ef9b62197b4c83f3feb089fb89133e0e9a0ef089ee0ee867d50509f4912464be41cd7b2d5bed4
SSDEEP

24576:qPsn9+gS6uHk1U4DHPeT97o+hzy3cHoORwqetii6hsuiWZJFN4IGy0:qELS6uH8UcGT9oHiohCd

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2096 2320 WerFault.exe 9f45dd6ded444bb7af801b51d61285b4d1f5190e55556c0aadc680f7e547e63b.exe

pid	pid_target	process	target process
2096	2320	WerFault.exe	9f45dd6ded444bb7af801b51d61285b4d1f5190e55556c0aadc680f7e547e63b.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

9f45dd6ded444bb7af801b51d61285b4d1f5190e55556c0aadc680f7e547e63b.exe

description	pid	process	target process
PID 2320 wrote to memory of 2096	2320	9f45dd6ded444bb7af801b51d61285b4d1f5190e55556c0aadc680f7e547e63b.exe	WerFault.exe
PID 2320 wrote to memory of 2096	2320	9f45dd6ded444bb7af801b51d61285b4d1f5190e55556c0aadc680f7e547e63b.exe	WerFault.exe
PID 2320 wrote to memory of 2096	2320	9f45dd6ded444bb7af801b51d61285b4d1f5190e55556c0aadc680f7e547e63b.exe	WerFault.exe
PID 2320 wrote to memory of 2096	2320	9f45dd6ded444bb7af801b51d61285b4d1f5190e55556c0aadc680f7e547e63b.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9f45dd6ded444bb7af801b51d61285b4d1f5190e55556c0aadc680f7e547e63b.exe
"C:\Users\Admin\AppData\Local\Temp\9f45dd6ded444bb7af801b51d61285b4d1f5190e55556c0aadc680f7e547e63b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 556
2⤵
- Program crash
PID:2096

memory/2320-0-0x0000000001160000-0x0000000001416000-memory.dmp

Filesize
2.7MB

Download
memory/2320-1-0x0000000074BB0000-0x000000007529E000-memory.dmp

Filesize
6.9MB

Download
memory/2320-2-0x0000000074BB0000-0x000000007529E000-memory.dmp

Filesize
6.9MB

Download