27cd0a0d702859fa675da836879b97bc2da1e311f2e81fb32370425f9fcca3ae

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 18:58

Target

27cd0a0d702859fa675da836879b97bc2da1e311f2e81fb32370425f9fcca3ae.exe
Size

6KB
MD5

827e1df4f4ebd39123dc9b59cf5c8740
SHA1

f8741c370876a7e9c12bf29c0c094c55d95294a5
SHA256

27cd0a0d702859fa675da836879b97bc2da1e311f2e81fb32370425f9fcca3ae
SHA512

86a07906821b82df1f2c1061c1566717ac0f3879f73dcaba75343931b7bf1ffe7c2d8b63b10e36b6e309c8d5792dac454a9833f0d95fb9fa076e4d7871145229
SSDEEP

48:SSbt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9uVW:/0mIGnFc/38+N4ZHJWSY9FI5Wqix

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2284	2172	27cd0a0d702859fa675da836879b97bc2da1e311f2e81fb32370425f9fcca3ae.exe	28
PID 2172 wrote to memory of 2284	2172	27cd0a0d702859fa675da836879b97bc2da1e311f2e81fb32370425f9fcca3ae.exe	28
PID 2172 wrote to memory of 2284	2172	27cd0a0d702859fa675da836879b97bc2da1e311f2e81fb32370425f9fcca3ae.exe	28

C:\Users\Admin\AppData\Local\Temp\27cd0a0d702859fa675da836879b97bc2da1e311f2e81fb32370425f9fcca3ae.exe
"C:\Users\Admin\AppData\Local\Temp\27cd0a0d702859fa675da836879b97bc2da1e311f2e81fb32370425f9fcca3ae.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2172 -s 32
  2⤵
  PID:2284