3bc727b7bd04ea5882298b848e7a73f8570f8b009b2653f413569a79e145cdc8

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 19:02

Target

3bc727b7bd04ea5882298b848e7a73f8570f8b009b2653f413569a79e145cdc8.exe
Size

231KB
MD5

52bea3ddd4d93248566289cc42bfb1f9
SHA1

e50dd1445872acfed1a076c47309c7628de4904d
SHA256

3bc727b7bd04ea5882298b848e7a73f8570f8b009b2653f413569a79e145cdc8
SHA512

3cf1e9ff6bee432916d7fd0b0f26da4c6f411fbd64cc7fb2d499a9c6666080e932d7f5081ec8d3162d5941d2ca312d3d96a726b3d908fd11ff93b47fc4f676b8
SSDEEP

3072:pkcO5vI+sJ0A3UyPr93DnBzk1b1MnWqa7c2lqezUG3L/KL6E+bYVcugx+cB/LiJO:p2I+2VEyPgR1MW1c2lEeE+bYVli/oO

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1956 1636 WerFault.exe 3bc727b7bd04ea5882298b848e7a73f8570f8b009b2653f413569a79e145cdc8.exe

pid	pid_target	process	target process
1956	1636	WerFault.exe	3bc727b7bd04ea5882298b848e7a73f8570f8b009b2653f413569a79e145cdc8.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3bc727b7bd04ea5882298b848e7a73f8570f8b009b2653f413569a79e145cdc8.exe

description	pid	process	target process
PID 1636 wrote to memory of 1956	1636	3bc727b7bd04ea5882298b848e7a73f8570f8b009b2653f413569a79e145cdc8.exe	WerFault.exe
PID 1636 wrote to memory of 1956	1636	3bc727b7bd04ea5882298b848e7a73f8570f8b009b2653f413569a79e145cdc8.exe	WerFault.exe
PID 1636 wrote to memory of 1956	1636	3bc727b7bd04ea5882298b848e7a73f8570f8b009b2653f413569a79e145cdc8.exe	WerFault.exe
PID 1636 wrote to memory of 1956	1636	3bc727b7bd04ea5882298b848e7a73f8570f8b009b2653f413569a79e145cdc8.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3bc727b7bd04ea5882298b848e7a73f8570f8b009b2653f413569a79e145cdc8.exe
"C:\Users\Admin\AppData\Local\Temp\3bc727b7bd04ea5882298b848e7a73f8570f8b009b2653f413569a79e145cdc8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 100
2⤵
- Program crash
PID:1956

memory/1636-55-0x00000000003A0000-0x00000000003B2000-memory.dmp

Filesize
72KB

Download
memory/1956-54-0x0000000000000000-mapping.dmp

Download