09ad84f8dde519aa02e92ffce896f55271105ceaab7e0f0a1f1ca9fee90650ff

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 22:19

Target

09ad84f8dde519aa02e92ffce896f55271105ceaab7e0f0a1f1ca9fee90650ff.exe
Size

377KB
MD5

1a6b4d357d1b8bab80524e40be1b2698
SHA1

70961ace92a0ebfdb38ae27a22181fb5a4f7d440
SHA256

09ad84f8dde519aa02e92ffce896f55271105ceaab7e0f0a1f1ca9fee90650ff
SHA512

67484dcb04fc15b09b88679fd3ac860991cebe97c07a27bf9e425e8277def7f61d244690ee582c2be72d0dda3fa486b53382f3e3ad368602d176c5f72a77de67
SSDEEP

6144:NqW5NIK5m09C0h5t4mnNpZO+Ua2PsQxDnK6gDelK88JqeGq0DLt+7SHo:8W5NIYF4mnZO+Ua2zxDnKrZJqtHLt+mI

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2192 2852 WerFault.exe 09ad84f8dde519aa02e92ffce896f55271105ceaab7e0f0a1f1ca9fee90650ff.exe

pid	pid_target	process	target process
2192	2852	WerFault.exe	09ad84f8dde519aa02e92ffce896f55271105ceaab7e0f0a1f1ca9fee90650ff.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

09ad84f8dde519aa02e92ffce896f55271105ceaab7e0f0a1f1ca9fee90650ff.exe

description	pid	process	target process
PID 2852 wrote to memory of 2192	2852	09ad84f8dde519aa02e92ffce896f55271105ceaab7e0f0a1f1ca9fee90650ff.exe	WerFault.exe
PID 2852 wrote to memory of 2192	2852	09ad84f8dde519aa02e92ffce896f55271105ceaab7e0f0a1f1ca9fee90650ff.exe	WerFault.exe
PID 2852 wrote to memory of 2192	2852	09ad84f8dde519aa02e92ffce896f55271105ceaab7e0f0a1f1ca9fee90650ff.exe	WerFault.exe
PID 2852 wrote to memory of 2192	2852	09ad84f8dde519aa02e92ffce896f55271105ceaab7e0f0a1f1ca9fee90650ff.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\09ad84f8dde519aa02e92ffce896f55271105ceaab7e0f0a1f1ca9fee90650ff.exe
"C:\Users\Admin\AppData\Local\Temp\09ad84f8dde519aa02e92ffce896f55271105ceaab7e0f0a1f1ca9fee90650ff.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 36
2⤵
- Program crash
PID:2192

memory/2852-0-0x00000000008EE000-0x00000000008F0000-memory.dmp

Filesize
8KB

Download