48c191383989ff5566b5a7a95a39efcdcbdc5fa1f787df7e1746bc32cc70c1e5

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 19:06

Target

41ad32f02e41703586d1bc838d7c6fc5.exe
Size

185KB
MD5

41ad32f02e41703586d1bc838d7c6fc5
SHA1

e47e066a85e6567bf918700be71d066fd8aa3719
SHA256

48c191383989ff5566b5a7a95a39efcdcbdc5fa1f787df7e1746bc32cc70c1e5
SHA512

dd716c0fe8ed8cc04c4e485248ce00a8b833368b41a05f2802c7bd54244b28ae3b5f6db421eee415c0aff863f8e321285f5f9b672f4597269fb846915afaea9d
SSDEEP

3072:y16sgRWb6ldN+64TKdQXjQvrk7z7HmBM1sCT17rEZg1Otr1AcKq1io/JagmGk:BsX66jj6k/7A+7rE+str1Alsi4mp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2684	2772	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2684	2772	41ad32f02e41703586d1bc838d7c6fc5.exe	28
PID 2772 wrote to memory of 2684	2772	41ad32f02e41703586d1bc838d7c6fc5.exe	28
PID 2772 wrote to memory of 2684	2772	41ad32f02e41703586d1bc838d7c6fc5.exe	28
PID 2772 wrote to memory of 2684	2772	41ad32f02e41703586d1bc838d7c6fc5.exe	28

C:\Users\Admin\AppData\Local\Temp\41ad32f02e41703586d1bc838d7c6fc5.exe
"C:\Users\Admin\AppData\Local\Temp\41ad32f02e41703586d1bc838d7c6fc5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 100
  2⤵
  - Program crash
  PID:2684