c48d4fe5a60352c405d72c77eb955f9d4a392ae74757d8163392eb84bf694df9

Analysis

max time kernel
39s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 16:33

Target

c48d4fe5a60352c405d72c77eb955f9d4a392ae74757d8163392eb84bf694df9.exe
Size

88KB
MD5

7307bf91299c35586a5a1dbc37170e99
SHA1

a67795814d038631824a5a1347dca2ee71ef9a29
SHA256

c48d4fe5a60352c405d72c77eb955f9d4a392ae74757d8163392eb84bf694df9
SHA512

5a0e4f104ef2d0d099594ecd4cd315816efb0ce5a381e355edef5c9a537b1ae2ae3413afdd65ddb07b9f77d292c5b3ac840e8332df95c0a75bcb56c7f2b7c9f8
SSDEEP

1536:utH0WKh1ZuG6J/TV8wNd1yh96g0DcMlOChPt7zNxbeH7cQpGV+v79:uhE1Z36J/TV8wNd9gIfOChPt7zNxqH73

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1012	1920	WerFault.exe	12

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 1012	1920	c48d4fe5a60352c405d72c77eb955f9d4a392ae74757d8163392eb84bf694df9.exe	28
PID 1920 wrote to memory of 1012	1920	c48d4fe5a60352c405d72c77eb955f9d4a392ae74757d8163392eb84bf694df9.exe	28
PID 1920 wrote to memory of 1012	1920	c48d4fe5a60352c405d72c77eb955f9d4a392ae74757d8163392eb84bf694df9.exe	28
PID 1920 wrote to memory of 1012	1920	c48d4fe5a60352c405d72c77eb955f9d4a392ae74757d8163392eb84bf694df9.exe	28

C:\Users\Admin\AppData\Local\Temp\c48d4fe5a60352c405d72c77eb955f9d4a392ae74757d8163392eb84bf694df9.exe
"C:\Users\Admin\AppData\Local\Temp\c48d4fe5a60352c405d72c77eb955f9d4a392ae74757d8163392eb84bf694df9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 120
  2⤵
  - Program crash
  PID:1012