0c10d4b592772c9fde50ab550952439aa3cdbafe63f1ca8a7a2072a8d160f607

Analysis

max time kernel
41s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 18:34

Target

0c10d4b592772c9fde50ab550952439aa3cdbafe63f1ca8a7a2072a8d160f607.exe
Size

258KB
MD5

017781c02c259911dc729afbaabb53de
SHA1

b2ca9a775c6d4bf291e0045b853cf5ea6149b100
SHA256

0c10d4b592772c9fde50ab550952439aa3cdbafe63f1ca8a7a2072a8d160f607
SHA512

a3fc473eb382228f3997c9e9bf2fe7608383e5f24c4700542e51341af9cb1b57fd12a1a3bfad546dfc01d1d816b07c60d7c80f5beab90852f7d6d7ba2b4e63b6
SSDEEP

3072:dwf8gpTK+VzEgMBvPQFAcF+WtfMvs+uapOfQPR4SlpDKb7ZJ8+vovsPbvWwzBcWn:qpTjw7O8WtfauapOIPuADKX8JsrWwzUg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1748	1492	WerFault.exe	5

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1748	1492	0c10d4b592772c9fde50ab550952439aa3cdbafe63f1ca8a7a2072a8d160f607.exe	27
PID 1492 wrote to memory of 1748	1492	0c10d4b592772c9fde50ab550952439aa3cdbafe63f1ca8a7a2072a8d160f607.exe	27
PID 1492 wrote to memory of 1748	1492	0c10d4b592772c9fde50ab550952439aa3cdbafe63f1ca8a7a2072a8d160f607.exe	27
PID 1492 wrote to memory of 1748	1492	0c10d4b592772c9fde50ab550952439aa3cdbafe63f1ca8a7a2072a8d160f607.exe	27

C:\Users\Admin\AppData\Local\Temp\0c10d4b592772c9fde50ab550952439aa3cdbafe63f1ca8a7a2072a8d160f607.exe
"C:\Users\Admin\AppData\Local\Temp\0c10d4b592772c9fde50ab550952439aa3cdbafe63f1ca8a7a2072a8d160f607.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 176
  2⤵
  - Program crash
  PID:1748

memory/1492-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1492-56-0x0000000000F90000-0x0000000000FD1000-memory.dmp

Filesize
260KB

Download