9ecd68d34fc10f985387e0458ebe19a4f5aa2bc043ac27e9d6af1e749c1fd5de

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 01:17

Target

9ecd68d34fc10f985387e0458ebe19a4f5aa2bc043ac27e9d6af1e749c1fd5de.exe
Size

254KB
MD5

3f35678cd34c9b01412ff50d0f0e8565
SHA1

263a0f2aebef87006d2b17351adbd5e70144ddfc
SHA256

9ecd68d34fc10f985387e0458ebe19a4f5aa2bc043ac27e9d6af1e749c1fd5de
SHA512

f1c61d75037c1b21a6de3ab5c6a4ac1409189fbb5f7262bde57d5d218342e78a2254eebcb31e158fc3f901bcb64d6dd3810d603454ae3ddac12820a8baec4b6d
SSDEEP

3072:9mQLIwpIEoGIKhNj0nlPpFlpGIwgKSWTREJdKSWTREJQKSWTREJvVJ3cSjc6RDua:9ClvfyjyCr3toRu4Y

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2468	2192	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2468	2192	9ecd68d34fc10f985387e0458ebe19a4f5aa2bc043ac27e9d6af1e749c1fd5de.exe	29
PID 2192 wrote to memory of 2468	2192	9ecd68d34fc10f985387e0458ebe19a4f5aa2bc043ac27e9d6af1e749c1fd5de.exe	29
PID 2192 wrote to memory of 2468	2192	9ecd68d34fc10f985387e0458ebe19a4f5aa2bc043ac27e9d6af1e749c1fd5de.exe	29
PID 2192 wrote to memory of 2468	2192	9ecd68d34fc10f985387e0458ebe19a4f5aa2bc043ac27e9d6af1e749c1fd5de.exe	29

C:\Users\Admin\AppData\Local\Temp\9ecd68d34fc10f985387e0458ebe19a4f5aa2bc043ac27e9d6af1e749c1fd5de.exe
"C:\Users\Admin\AppData\Local\Temp\9ecd68d34fc10f985387e0458ebe19a4f5aa2bc043ac27e9d6af1e749c1fd5de.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 556
  2⤵
  - Program crash
  PID:2468

memory/2192-0-0x00000000008D0000-0x0000000000916000-memory.dmp

Filesize
280KB

Download
memory/2192-1-0x0000000074500000-0x0000000074BEE000-memory.dmp

Filesize
6.9MB

Download
memory/2192-2-0x0000000074500000-0x0000000074BEE000-memory.dmp

Filesize
6.9MB

Download