9bdcec1de9f9e19ecf00ac931d4395ac26d7c8abd08a605b6b459f799e4acd67

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 21:16

Target

c9a3d2ad3ebe47f93a654bc41634daef.exe
Size

406KB
MD5

c9a3d2ad3ebe47f93a654bc41634daef
SHA1

61e7b0206cf6729c0d3e293e0127e9438b1f58e1
SHA256

9bdcec1de9f9e19ecf00ac931d4395ac26d7c8abd08a605b6b459f799e4acd67
SHA512

fc19cdb5e821f03b4fc68af829f4c3139889f60f1f2b8ce92b96503294964af1cf0097a38a0359df2fa83b7b5088885acc61a1cbf2ead5a89f0db2e60a387beb
SSDEEP

6144:tptp/F2yOadVqCJM5X2nHCKVBzakE7G/XAxb5vSr31RYCrLhCtmWosqd:L/3z6imX2nHJVBz+1xbh831RYCrcr8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2904	1752	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2904	1752	c9a3d2ad3ebe47f93a654bc41634daef.exe	28
PID 1752 wrote to memory of 2904	1752	c9a3d2ad3ebe47f93a654bc41634daef.exe	28
PID 1752 wrote to memory of 2904	1752	c9a3d2ad3ebe47f93a654bc41634daef.exe	28
PID 1752 wrote to memory of 2904	1752	c9a3d2ad3ebe47f93a654bc41634daef.exe	28

C:\Users\Admin\AppData\Local\Temp\c9a3d2ad3ebe47f93a654bc41634daef.exe
"C:\Users\Admin\AppData\Local\Temp\c9a3d2ad3ebe47f93a654bc41634daef.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 200
  2⤵
  - Program crash
  PID:2904

memory/1752-0-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1752-1-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download