1a159e821ef5ca6c6ace5b5c863827dc4b30bca1283f92ddf5c73c580ad05aa4

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 10:51

Target

48c51b3089d5eea4a61a9aa18a9a5cc2.exe
Size

52KB
MD5

48c51b3089d5eea4a61a9aa18a9a5cc2
SHA1

1c12db58521861fda8fbd69d931202423b7f38ce
SHA256

1a159e821ef5ca6c6ace5b5c863827dc4b30bca1283f92ddf5c73c580ad05aa4
SHA512

64ff049300a78dce2490ee859086b871d0803a2377f2e5a4e2f20caef96cfafcba1ad29dc1e23d2356fea46e9aa5423f4f3d6097425ba23048130bef0911edcb
SSDEEP

768:zZrRZq9XNrrdxfVXcPquK8fUPmmbt22dkHXpf+FVqEiMPrGqzFjxItD/3KFjBFsy:JRclrnftcPquKcUjtQ3pf+FV/YujHsy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2672	2220	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2672	2220	48c51b3089d5eea4a61a9aa18a9a5cc2.exe	28
PID 2220 wrote to memory of 2672	2220	48c51b3089d5eea4a61a9aa18a9a5cc2.exe	28
PID 2220 wrote to memory of 2672	2220	48c51b3089d5eea4a61a9aa18a9a5cc2.exe	28
PID 2220 wrote to memory of 2672	2220	48c51b3089d5eea4a61a9aa18a9a5cc2.exe	28

C:\Users\Admin\AppData\Local\Temp\48c51b3089d5eea4a61a9aa18a9a5cc2.exe
"C:\Users\Admin\AppData\Local\Temp\48c51b3089d5eea4a61a9aa18a9a5cc2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 156
  2⤵
  - Program crash
  PID:2672