10027c98290be1aa46ab8524217d8d1b4d2535b7e908d22940e8f3693546dc01

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 14:12

Target

10027c98290be1aa46ab8524217d8d1b4d2535b7e908d22940e8f3693546dc01.exe
Size

76KB
MD5

07b89dc9ace0722645e81d317b069143
SHA1

23e8bdc357f426604abaf8f8be0bb53ac1cd5ee9
SHA256

10027c98290be1aa46ab8524217d8d1b4d2535b7e908d22940e8f3693546dc01
SHA512

38728a6fe9187dde7287e489e04986bac6153915ba827b31c291bddd6c44fdd23b787f0bc5233011afc51a2039395b7b27f9d2e3a2bdb18328bfa592bba648f7
SSDEEP

1536:SXXXfbpZ/nZ141D7hUd8H2vo6S0eC0LiDZwIL1cghjnC2gjEErxTWDTMqhGKYIZ5:qE32QvNPg17nXgjBkMqhGKZTbx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1344	1204	WerFault.exe	21

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1344	1204	10027c98290be1aa46ab8524217d8d1b4d2535b7e908d22940e8f3693546dc01.exe	27
PID 1204 wrote to memory of 1344	1204	10027c98290be1aa46ab8524217d8d1b4d2535b7e908d22940e8f3693546dc01.exe	27
PID 1204 wrote to memory of 1344	1204	10027c98290be1aa46ab8524217d8d1b4d2535b7e908d22940e8f3693546dc01.exe	27
PID 1204 wrote to memory of 1344	1204	10027c98290be1aa46ab8524217d8d1b4d2535b7e908d22940e8f3693546dc01.exe	27

C:\Users\Admin\AppData\Local\Temp\10027c98290be1aa46ab8524217d8d1b4d2535b7e908d22940e8f3693546dc01.exe
"C:\Users\Admin\AppData\Local\Temp\10027c98290be1aa46ab8524217d8d1b4d2535b7e908d22940e8f3693546dc01.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 36
  2⤵
  - Program crash
  PID:1344

memory/1204-55-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1344-54-0x0000000000000000-mapping.dmp

Download