10cd71226b4ff1c5234157cf60f1e8333d00bb10e170fe0d49ad5dffe51af431

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 04:10

Target

10cd71226b4ff1c5234157cf60f1e8333d00bb10e170fe0d49ad5dffe51af431.exe
Size

388KB
MD5

59898a8214ccb58cacd76cfd066d749b
SHA1

a23535eee3c82acc3561c93f14c2b1c62a7c19a1
SHA256

10cd71226b4ff1c5234157cf60f1e8333d00bb10e170fe0d49ad5dffe51af431
SHA512

53fe11ae293aec3afb48be5658d06319dceee59afe1e79fe20fad7b347c5f1032e7ad3c0d010800a6daae05a23a379994d8078aa1047386de9d9067e8fe8da44
SSDEEP

3072:e2voeN+jaiG17Ef5KlrKnBZ59oZSmveDlcjIV8jlwIPnU+V4EFFCcll3H3rH3XDY:ZQeNai17Y56rKnBfWhveajzxwI/U

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

480 1760 WerFault.exe 10cd71226b4ff1c5234157cf60f1e8333d00bb10e170fe0d49ad5dffe51af431.exe

pid	pid_target	process	target process
480	1760	WerFault.exe	10cd71226b4ff1c5234157cf60f1e8333d00bb10e170fe0d49ad5dffe51af431.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

10cd71226b4ff1c5234157cf60f1e8333d00bb10e170fe0d49ad5dffe51af431.exe

description	pid	process	target process
PID 1760 wrote to memory of 480	1760	10cd71226b4ff1c5234157cf60f1e8333d00bb10e170fe0d49ad5dffe51af431.exe	WerFault.exe
PID 1760 wrote to memory of 480	1760	10cd71226b4ff1c5234157cf60f1e8333d00bb10e170fe0d49ad5dffe51af431.exe	WerFault.exe
PID 1760 wrote to memory of 480	1760	10cd71226b4ff1c5234157cf60f1e8333d00bb10e170fe0d49ad5dffe51af431.exe	WerFault.exe
PID 1760 wrote to memory of 480	1760	10cd71226b4ff1c5234157cf60f1e8333d00bb10e170fe0d49ad5dffe51af431.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\10cd71226b4ff1c5234157cf60f1e8333d00bb10e170fe0d49ad5dffe51af431.exe
"C:\Users\Admin\AppData\Local\Temp\10cd71226b4ff1c5234157cf60f1e8333d00bb10e170fe0d49ad5dffe51af431.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 100
2⤵
- Program crash
PID:480