48d6f90231d770b1dd753b3c4a5702950c78798146a030cf10428a4c6c50b0e3

Analysis

max time kernel
31s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
18/05/2023, 04:32

Target

file.exe
Size

1.1MB
MD5

1bb01479852da120dbfb4f447cf1fee8
SHA1

218559b38a8566c3c6f0941dd08bf4d4237fdc49
SHA256

48d6f90231d770b1dd753b3c4a5702950c78798146a030cf10428a4c6c50b0e3
SHA512

6edd8e78fddcf1b5bd2bdb5d562ec6c996b730db107df5a8c5544cf0a8988ce7ce6692b2447b66a2f07ab144cda1f31464ea50aa020274e99440fe78624813eb
SSDEEP

24576:cvy6yIgrURLsKplyhpxZBcFiV9I0Y3h5d9+121/WRQditbaJKnmii32i4gETi5li:cvy6yIgrURLsKplyhpxZBcFiV9I0Y3h4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1652	924	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 1652	924	file.exe	28
PID 924 wrote to memory of 1652	924	file.exe	28
PID 924 wrote to memory of 1652	924	file.exe	28
PID 924 wrote to memory of 1652	924	file.exe	28

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 564
  2⤵
  - Program crash
  PID:1652

memory/924-54-0x0000000000980000-0x0000000000A98000-memory.dmp

Filesize
1.1MB

Download