453f1bcae7bbc4d5d3aa345dd50797b38d6beeed0fdc72471739a794599fe9d8

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 10:22

Target

48b765c583b18216c25a7c2608d11959.exe
Size

56KB
MD5

48b765c583b18216c25a7c2608d11959
SHA1

ccd8b0202fd190fc27c98761e61317c359808598
SHA256

453f1bcae7bbc4d5d3aa345dd50797b38d6beeed0fdc72471739a794599fe9d8
SHA512

5153b251f811466feb72d8d8e8391261bff8ecb4377c7809a5aeab6f1f7a72037eb540275d1b476262ab15080f6831aa2595295e7dbee77b2bdbc044aba039e7
SSDEEP

768:/YcYtEnMEdDRVeTTBY0p5/TOurKrT1L1hOErD2w/1H54mXdnh:/YcYHEhRVqTN9TO7rw6D2KGk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2188	2676	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2188	2676	48b765c583b18216c25a7c2608d11959.exe	28
PID 2676 wrote to memory of 2188	2676	48b765c583b18216c25a7c2608d11959.exe	28
PID 2676 wrote to memory of 2188	2676	48b765c583b18216c25a7c2608d11959.exe	28
PID 2676 wrote to memory of 2188	2676	48b765c583b18216c25a7c2608d11959.exe	28

C:\Users\Admin\AppData\Local\Temp\48b765c583b18216c25a7c2608d11959.exe
"C:\Users\Admin\AppData\Local\Temp\48b765c583b18216c25a7c2608d11959.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 140
  2⤵
  - Program crash
  PID:2188

memory/2676-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2676-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download