27ff9f77ba51d7cb09924825d114ebeeca3c4ac8aeef70c51666cfe7b945bdea

Analysis

max time kernel
122s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:16

Target

27ff9f77ba51d7cb09924825d114ebeeca3c4ac8aeef70c51666cfe7b945bdea.exe
Size

239KB
MD5

034ee51b44c8d12a74cf270bad3ef127
SHA1

07fb4c23a3e4268b3fbb89829261a52f91073799
SHA256

27ff9f77ba51d7cb09924825d114ebeeca3c4ac8aeef70c51666cfe7b945bdea
SHA512

90e1fea10efbe3f0a05b65a67693b98b0f5e929f8eacc12c655c7985b56aa58d6e22d0418a008e5b941e3b4d8db49ae0d999f1153f2d0ea0671868de7d3a9afa
SSDEEP

6144:xGhK/Il+Fj9XNm8yV5B9uDciSEK8sJbkn:dAcFJXNm8c7iSESbkn

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1512 1384 WerFault.exe 27ff9f77ba51d7cb09924825d114ebeeca3c4ac8aeef70c51666cfe7b945bdea.exe

pid	pid_target	process	target process
1512	1384	WerFault.exe	27ff9f77ba51d7cb09924825d114ebeeca3c4ac8aeef70c51666cfe7b945bdea.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

27ff9f77ba51d7cb09924825d114ebeeca3c4ac8aeef70c51666cfe7b945bdea.exe

description	pid	process	target process
PID 1384 wrote to memory of 1512	1384	27ff9f77ba51d7cb09924825d114ebeeca3c4ac8aeef70c51666cfe7b945bdea.exe	WerFault.exe
PID 1384 wrote to memory of 1512	1384	27ff9f77ba51d7cb09924825d114ebeeca3c4ac8aeef70c51666cfe7b945bdea.exe	WerFault.exe
PID 1384 wrote to memory of 1512	1384	27ff9f77ba51d7cb09924825d114ebeeca3c4ac8aeef70c51666cfe7b945bdea.exe	WerFault.exe
PID 1384 wrote to memory of 1512	1384	27ff9f77ba51d7cb09924825d114ebeeca3c4ac8aeef70c51666cfe7b945bdea.exe	WerFault.exe
PID 1384 wrote to memory of 1512	1384	27ff9f77ba51d7cb09924825d114ebeeca3c4ac8aeef70c51666cfe7b945bdea.exe	WerFault.exe
PID 1384 wrote to memory of 1512	1384	27ff9f77ba51d7cb09924825d114ebeeca3c4ac8aeef70c51666cfe7b945bdea.exe	WerFault.exe
PID 1384 wrote to memory of 1512	1384	27ff9f77ba51d7cb09924825d114ebeeca3c4ac8aeef70c51666cfe7b945bdea.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\27ff9f77ba51d7cb09924825d114ebeeca3c4ac8aeef70c51666cfe7b945bdea.exe
"C:\Users\Admin\AppData\Local\Temp\27ff9f77ba51d7cb09924825d114ebeeca3c4ac8aeef70c51666cfe7b945bdea.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 256
2⤵
- Program crash
PID:1512

memory/1384-54-0x0000000030000000-0x000000003003E000-memory.dmp

Filesize
248KB

Download
memory/1384-55-0x0000000076701000-0x0000000076703000-memory.dmp

Filesize
8KB

Download
memory/1384-56-0x00000000002D0000-0x000000000030E000-memory.dmp

Filesize
248KB

Download
memory/1384-58-0x0000000030000000-0x000000003003E000-memory.dmp

Filesize
248KB

Download
memory/1512-57-0x0000000000000000-mapping.dmp

Download