527d2a6cac2c208c0ab95e0f80252ff05c9625bdfe04606e3777d9d9bf6c920f

Analysis

max time kernel
41s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 16:28

Target

527d2a6cac2c208c0ab95e0f80252ff05c9625bdfe04606e3777d9d9bf6c920f.exe
Size

989KB
MD5

5a46552ecb6f46ff1c1d14cfb484bfe0
SHA1

786280b307c31f7cbfb4d4ef9342c12e02b98eb6
SHA256

527d2a6cac2c208c0ab95e0f80252ff05c9625bdfe04606e3777d9d9bf6c920f
SHA512

9de9a6f3f6358eb9ba4f8df3fa9e0ade56d5dd007f2c18658cc83b1c9795fce8d84a2864bec5f5713501d5fd2aeb6a8dfe18b5bdfda5769734760c88bb1c756a
SSDEEP

24576:4Nk+fLCJ8ztNuAHbzOfa0P14i0Pxb10SCYpD+z:4CfJ8ztNTQ9d41be+az

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1624	1516	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 1624	1516	527d2a6cac2c208c0ab95e0f80252ff05c9625bdfe04606e3777d9d9bf6c920f.exe	27
PID 1516 wrote to memory of 1624	1516	527d2a6cac2c208c0ab95e0f80252ff05c9625bdfe04606e3777d9d9bf6c920f.exe	27
PID 1516 wrote to memory of 1624	1516	527d2a6cac2c208c0ab95e0f80252ff05c9625bdfe04606e3777d9d9bf6c920f.exe	27
PID 1516 wrote to memory of 1624	1516	527d2a6cac2c208c0ab95e0f80252ff05c9625bdfe04606e3777d9d9bf6c920f.exe	27

C:\Users\Admin\AppData\Local\Temp\527d2a6cac2c208c0ab95e0f80252ff05c9625bdfe04606e3777d9d9bf6c920f.exe
"C:\Users\Admin\AppData\Local\Temp\527d2a6cac2c208c0ab95e0f80252ff05c9625bdfe04606e3777d9d9bf6c920f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 116
  2⤵
  - Program crash
  PID:1624

memory/1516-54-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download
memory/1516-56-0x0000000000400000-0x000000000080C000-memory.dmp

Filesize
4.0MB

Download