48f8f3fca630c25650619067daa52a512867a0d90f841f45b6c0976af5fe3751

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
31/10/2022, 00:18

Target

48f8f3fca630c25650619067daa52a512867a0d90f841f45b6c0976af5fe3751.exe
Size

246KB
MD5

a1dc992c883fd91138bc95997617b77c
SHA1

f92f33644d922d692896e7c38b041c833201cb07
SHA256

48f8f3fca630c25650619067daa52a512867a0d90f841f45b6c0976af5fe3751
SHA512

0d80b44d364313b78f39cf6ef67d2dcf225f50e9030477c7e44aba428d07114821a984b921ecc7fc3378fc0c1769cc17bbeb465e3b55a239a138754db8f0fd57
SSDEEP

6144:K83nYbxKVJ3nCMkQe5HZAsHFZlxq7+Z1:KXsHyMqLHFZlxWu1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2012	1992	WerFault.exe	22

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2012	1992	48f8f3fca630c25650619067daa52a512867a0d90f841f45b6c0976af5fe3751.exe	27
PID 1992 wrote to memory of 2012	1992	48f8f3fca630c25650619067daa52a512867a0d90f841f45b6c0976af5fe3751.exe	27
PID 1992 wrote to memory of 2012	1992	48f8f3fca630c25650619067daa52a512867a0d90f841f45b6c0976af5fe3751.exe	27
PID 1992 wrote to memory of 2012	1992	48f8f3fca630c25650619067daa52a512867a0d90f841f45b6c0976af5fe3751.exe	27
PID 1992 wrote to memory of 2012	1992	48f8f3fca630c25650619067daa52a512867a0d90f841f45b6c0976af5fe3751.exe	27
PID 1992 wrote to memory of 2012	1992	48f8f3fca630c25650619067daa52a512867a0d90f841f45b6c0976af5fe3751.exe	27
PID 1992 wrote to memory of 2012	1992	48f8f3fca630c25650619067daa52a512867a0d90f841f45b6c0976af5fe3751.exe	27

C:\Users\Admin\AppData\Local\Temp\48f8f3fca630c25650619067daa52a512867a0d90f841f45b6c0976af5fe3751.exe
"C:\Users\Admin\AppData\Local\Temp\48f8f3fca630c25650619067daa52a512867a0d90f841f45b6c0976af5fe3751.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 268
  2⤵
  - Program crash
  PID:2012

memory/1992-54-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1992-56-0x00000000001C0000-0x0000000000205000-memory.dmp

Filesize
276KB

Download
memory/1992-57-0x0000000000100000-0x0000000000145000-memory.dmp

Filesize
276KB

Download