7c217bc27a6671e8a9139926341ef9cb02b2418ddf9dce4343238657badd6a0c

Analysis

max time kernel
38s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:18

Target

7c217bc27a6671e8a9139926341ef9cb02b2418ddf9dce4343238657badd6a0c.exe
Size

71KB
MD5

07e90523615e9c51ea4de88775c7dd54
SHA1

bbd60a21d2c776b0d2d732e40b68f03713cbde29
SHA256

7c217bc27a6671e8a9139926341ef9cb02b2418ddf9dce4343238657badd6a0c
SHA512

0d8621ec4177a55bc2be480b55adb7ec7deafc55316a148d0c0870698f07993d405710c159fe63cfb2cc1c6ce6dd7a6f325280d0d78607b12b60dc32fac01a9c
SSDEEP

1536:ReJbvKKvNiQ9A3dhjFVsTxA/nk8XD++YySt8bx7QxhQP0olJrnPxM3TbeYtGv:ReJbCKvNiQ9A3dhj/gx4qSStM7Qx6plF

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1988 2028 WerFault.exe 7c217bc27a6671e8a9139926341ef9cb02b2418ddf9dce4343238657badd6a0c.exe

pid	pid_target	process	target process
1988	2028	WerFault.exe	7c217bc27a6671e8a9139926341ef9cb02b2418ddf9dce4343238657badd6a0c.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7c217bc27a6671e8a9139926341ef9cb02b2418ddf9dce4343238657badd6a0c.exe

description	pid	process	target process
PID 2028 wrote to memory of 1988	2028	7c217bc27a6671e8a9139926341ef9cb02b2418ddf9dce4343238657badd6a0c.exe	WerFault.exe
PID 2028 wrote to memory of 1988	2028	7c217bc27a6671e8a9139926341ef9cb02b2418ddf9dce4343238657badd6a0c.exe	WerFault.exe
PID 2028 wrote to memory of 1988	2028	7c217bc27a6671e8a9139926341ef9cb02b2418ddf9dce4343238657badd6a0c.exe	WerFault.exe
PID 2028 wrote to memory of 1988	2028	7c217bc27a6671e8a9139926341ef9cb02b2418ddf9dce4343238657badd6a0c.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7c217bc27a6671e8a9139926341ef9cb02b2418ddf9dce4343238657badd6a0c.exe
"C:\Users\Admin\AppData\Local\Temp\7c217bc27a6671e8a9139926341ef9cb02b2418ddf9dce4343238657badd6a0c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 36
2⤵
- Program crash
PID:1988

memory/1988-54-0x0000000000000000-mapping.dmp

Download
memory/2028-55-0x0000000000400000-0x000000000042C489-memory.dmp

Filesize
177KB

Download