c27b1470c6eae6b692b5b4e942a3db0eb6cb64ff68e893f06c64b48266c86852

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 18:14

Target

c27b1470c6eae6b692b5b4e942a3db0eb6cb64ff68e893f06c64b48266c86852.exe
Size

94KB
MD5

258e4f2c0fbae52ac5753ba07a6d0b64
SHA1

0e9058b18946dab4351d7534a2b4046ab8c740ae
SHA256

c27b1470c6eae6b692b5b4e942a3db0eb6cb64ff68e893f06c64b48266c86852
SHA512

b12aa1a68ce2e9ea4df215c940ed62d60d5d3d1ea5763d373e03928016116d98549e5737f1eacb591bd45de44e3f204839b7bfc23eedc56e4d2704186c30b63d
SSDEEP

1536:Z235b7vkmVN+1e3c+ibV561RBhoB1EqWU:U3lomT+s3cRSfB3qx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
956	996	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 956	996	c27b1470c6eae6b692b5b4e942a3db0eb6cb64ff68e893f06c64b48266c86852.exe	27
PID 996 wrote to memory of 956	996	c27b1470c6eae6b692b5b4e942a3db0eb6cb64ff68e893f06c64b48266c86852.exe	27
PID 996 wrote to memory of 956	996	c27b1470c6eae6b692b5b4e942a3db0eb6cb64ff68e893f06c64b48266c86852.exe	27
PID 996 wrote to memory of 956	996	c27b1470c6eae6b692b5b4e942a3db0eb6cb64ff68e893f06c64b48266c86852.exe	27

C:\Users\Admin\AppData\Local\Temp\c27b1470c6eae6b692b5b4e942a3db0eb6cb64ff68e893f06c64b48266c86852.exe
"C:\Users\Admin\AppData\Local\Temp\c27b1470c6eae6b692b5b4e942a3db0eb6cb64ff68e893f06c64b48266c86852.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 92
  2⤵
  - Program crash
  PID:956

memory/996-55-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download