48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 21:04

Target

48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe
Size

74KB
MD5

a5b01742cec671e5bcae18a7edc900f8
SHA1

1cd456a4185c19f03811cdf159df56a25e52c42f
SHA256

48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045
SHA512

da311b758aeb542158ff5b328ea474c4b4f945eee45f131651d5608efee403a844b726f5d5d6929aa4a75480580377076f9f231b7b510dc2472587c9b00aa58b
SSDEEP

1536:JXImvYaooWO4twEWsqaDOlI8PIpWk9rybuM8h2HNPCuxU31UL:ZYal4tP3qaaKlpWDbuhh2tbS32

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3004 1800 WerFault.exe 48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe

pid	pid_target	process	target process
3004	1800	WerFault.exe	48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe

description	pid	process	target process
PID 1800 wrote to memory of 3004	1800	48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe	WerFault.exe
PID 1800 wrote to memory of 3004	1800	48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe	WerFault.exe
PID 1800 wrote to memory of 3004	1800	48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe	WerFault.exe
PID 1800 wrote to memory of 3004	1800	48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe
"C:\Users\Admin\AppData\Local\Temp\48ebc663714ae75de7478dd0205b997244db6bf539e699ff3ab9533982b42045.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 536
2⤵
- Program crash
PID:3004

memory/1800-0-0x00000000747AE000-0x00000000747AF000-memory.dmp

Filesize
4KB

Download
memory/1800-1-0x0000000000DC0000-0x0000000000DDC000-memory.dmp

Filesize
112KB

Download
memory/1800-2-0x00000000747AE000-0x00000000747AF000-memory.dmp

Filesize
4KB

Download