032fac74838fd0e25c62104555b865f8273643b510d4e230486a14c5b58c7dd7

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 16:35

Target

48445bfa9459e7707ebb2abb6a6a5ee097468650df2a4ad1cb279324854a5c3b.exe
Size

54KB
MD5

d41c910389d9f8ca4b978d028dcb1bda
SHA1

73d1614bb957f466b85501113534b46a14a3d431
SHA256

48445bfa9459e7707ebb2abb6a6a5ee097468650df2a4ad1cb279324854a5c3b
SHA512

ef5be81e84a7074cd1f69f2dbd3b27dc9c9d62799b390f23ffba38e28c250d645a7aac236c0bab42741bc4711d7c49d21a7071258d37d2dbf2a9a6f5e7349e1c
SSDEEP

96:7DOtKOqtHAusyaGlp9khvXlsyCtxAgVC:7St2JAustGlp9khvXOySxA8C

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2412	1400	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 2412	1400	48445bfa9459e7707ebb2abb6a6a5ee097468650df2a4ad1cb279324854a5c3b.exe	29
PID 1400 wrote to memory of 2412	1400	48445bfa9459e7707ebb2abb6a6a5ee097468650df2a4ad1cb279324854a5c3b.exe	29
PID 1400 wrote to memory of 2412	1400	48445bfa9459e7707ebb2abb6a6a5ee097468650df2a4ad1cb279324854a5c3b.exe	29
PID 1400 wrote to memory of 2412	1400	48445bfa9459e7707ebb2abb6a6a5ee097468650df2a4ad1cb279324854a5c3b.exe	29

C:\Users\Admin\AppData\Local\Temp\48445bfa9459e7707ebb2abb6a6a5ee097468650df2a4ad1cb279324854a5c3b.exe
"C:\Users\Admin\AppData\Local\Temp\48445bfa9459e7707ebb2abb6a6a5ee097468650df2a4ad1cb279324854a5c3b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 48
  2⤵
  - Program crash
  PID:2412