9d5c20e8ba2953e6d70e694d537d5f1ff5a0b6fd0adc88f48a087eccc8f91a51

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 14:44

Target

9d5c20e8ba2953e6d70e694d537d5f1ff5a0b6fd0adc88f48a087eccc8f91a51.exe
Size

472KB
MD5

5e0db960120e6c67ccbc0b8a2cdaf6a7
SHA1

3b74573b5304f7c537f41e8827256bcf06d57953
SHA256

9d5c20e8ba2953e6d70e694d537d5f1ff5a0b6fd0adc88f48a087eccc8f91a51
SHA512

96049128d06b3307a08f6b6b3afa664ab8b7850975e458c606e1d901ef79fe4fcdd566c68dbbdc58c4009b76959297345f66c6db6f913dfe88adfc44b5316264
SSDEEP

12288:CxpIXPTj/kUR24H+GlAGEyQWzt6ABi/LzK:aCrjz24hu/yt64+

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1400 2224 WerFault.exe 9d5c20e8ba2953e6d70e694d537d5f1ff5a0b6fd0adc88f48a087eccc8f91a51.exe

pid	pid_target	process	target process
1400	2224	WerFault.exe	9d5c20e8ba2953e6d70e694d537d5f1ff5a0b6fd0adc88f48a087eccc8f91a51.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

9d5c20e8ba2953e6d70e694d537d5f1ff5a0b6fd0adc88f48a087eccc8f91a51.exe

description	pid	process	target process
PID 2224 wrote to memory of 1400	2224	9d5c20e8ba2953e6d70e694d537d5f1ff5a0b6fd0adc88f48a087eccc8f91a51.exe	WerFault.exe
PID 2224 wrote to memory of 1400	2224	9d5c20e8ba2953e6d70e694d537d5f1ff5a0b6fd0adc88f48a087eccc8f91a51.exe	WerFault.exe
PID 2224 wrote to memory of 1400	2224	9d5c20e8ba2953e6d70e694d537d5f1ff5a0b6fd0adc88f48a087eccc8f91a51.exe	WerFault.exe
PID 2224 wrote to memory of 1400	2224	9d5c20e8ba2953e6d70e694d537d5f1ff5a0b6fd0adc88f48a087eccc8f91a51.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9d5c20e8ba2953e6d70e694d537d5f1ff5a0b6fd0adc88f48a087eccc8f91a51.exe
"C:\Users\Admin\AppData\Local\Temp\9d5c20e8ba2953e6d70e694d537d5f1ff5a0b6fd0adc88f48a087eccc8f91a51.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 48
2⤵
- Program crash
PID:1400

memory/2224-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2224-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download