150ac54d1373965948caf8d14354053ecf69b7774b1ac7451f6c5cd51778b671

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
14-02-2023 05:19

Target

150ac54d1373965948caf8d14354053ecf69b7774b1ac7451f6c5cd51778b671.exe
Size

106KB
MD5

59adcde6747c9f49009fd5fb1c0522de
SHA1

735deebf4790654054ec978bd58bb4ecd044c212
SHA256

150ac54d1373965948caf8d14354053ecf69b7774b1ac7451f6c5cd51778b671
SHA512

3d95ad2fcf0c3f84e43ee3f3f672cec5d7608bb8d0f64168139a020ef884ec9a8f5bc7250b235fac2e7dafc26e9c598df3c2ac5997bf1190d84adb22579bc5e4
SSDEEP

384:EyKfsqwkYl1+r/ne4gyxDI99Sjvb99Sjvh:EyygUeck9Sbh9Sb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1324	1816	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 1324	1816	150ac54d1373965948caf8d14354053ecf69b7774b1ac7451f6c5cd51778b671.exe	28
PID 1816 wrote to memory of 1324	1816	150ac54d1373965948caf8d14354053ecf69b7774b1ac7451f6c5cd51778b671.exe	28
PID 1816 wrote to memory of 1324	1816	150ac54d1373965948caf8d14354053ecf69b7774b1ac7451f6c5cd51778b671.exe	28

C:\Users\Admin\AppData\Local\Temp\150ac54d1373965948caf8d14354053ecf69b7774b1ac7451f6c5cd51778b671.exe
"C:\Users\Admin\AppData\Local\Temp\150ac54d1373965948caf8d14354053ecf69b7774b1ac7451f6c5cd51778b671.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1816 -s 28
  2⤵
  - Program crash
  PID:1324