48c2685e113bf3d11122f39250a7d67c1a3bd940ac6f98001bbbcba7ec6c29ff

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
21-09-2023 15:31

Target

48c2685e113bf3d11122f39250a7d67c1a3bd940ac6f98001bbbcba7ec6c29ff.exe
Size

5KB
MD5

bfe3aaccf131d727996ea1cf91da8ae7
SHA1

25001357348e9939b0c2888a70d205da33d82aae
SHA256

48c2685e113bf3d11122f39250a7d67c1a3bd940ac6f98001bbbcba7ec6c29ff
SHA512

65e651ee5c82dc196e0099a165435d9f50cf0c53b419f697a2df8d6c4c15bfdd97fbb9a90bc95c436598c0f7adb299559c1bf572879b3fc9819ad864b381d530
SSDEEP

48:SJlXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7tGRuqSxp:eWLkFfNnOKYloIQ2pm2pbYSCxE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3068	2576	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 3068	2576	48c2685e113bf3d11122f39250a7d67c1a3bd940ac6f98001bbbcba7ec6c29ff.exe	28
PID 2576 wrote to memory of 3068	2576	48c2685e113bf3d11122f39250a7d67c1a3bd940ac6f98001bbbcba7ec6c29ff.exe	28
PID 2576 wrote to memory of 3068	2576	48c2685e113bf3d11122f39250a7d67c1a3bd940ac6f98001bbbcba7ec6c29ff.exe	28
PID 2576 wrote to memory of 3068	2576	48c2685e113bf3d11122f39250a7d67c1a3bd940ac6f98001bbbcba7ec6c29ff.exe	28

C:\Users\Admin\AppData\Local\Temp\48c2685e113bf3d11122f39250a7d67c1a3bd940ac6f98001bbbcba7ec6c29ff.exe
"C:\Users\Admin\AppData\Local\Temp\48c2685e113bf3d11122f39250a7d67c1a3bd940ac6f98001bbbcba7ec6c29ff.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 48
  2⤵
  - Program crash
  PID:3068