d1148eb27cd4476834945fb83c7ee31da59802378cbe1f9dbd42e6a858a234a6

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 06:05

Target

d1148eb27cd4476834945fb83c7ee31da59802378cbe1f9dbd42e6a858a234a6.exe
Size

527KB
MD5

297431a2e6758edfc0a6fbc07f4606aa
SHA1

edf98a082795ae79954c85bc8cebe56e3f6f1665
SHA256

d1148eb27cd4476834945fb83c7ee31da59802378cbe1f9dbd42e6a858a234a6
SHA512

25c876808d45916072ff8d35d7bc83a753fe92a8bd23607c19afa805eb945783f154a51beb9068de2fdc008079d25ca33c19d2313684eef5e99e140ac0ec4df2
SSDEEP

3072:wCaoAs101Pol0xPTM7mRCAdJSSxPUkl3VkMQTCk/dN92sdNhavtrVdewnAx3wmVe:wqDAwl0xPTMiR9JSSxPUKododHN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2820	3032	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2820	3032	d1148eb27cd4476834945fb83c7ee31da59802378cbe1f9dbd42e6a858a234a6.exe	30
PID 3032 wrote to memory of 2820	3032	d1148eb27cd4476834945fb83c7ee31da59802378cbe1f9dbd42e6a858a234a6.exe	30
PID 3032 wrote to memory of 2820	3032	d1148eb27cd4476834945fb83c7ee31da59802378cbe1f9dbd42e6a858a234a6.exe	30
PID 3032 wrote to memory of 2820	3032	d1148eb27cd4476834945fb83c7ee31da59802378cbe1f9dbd42e6a858a234a6.exe	30

C:\Users\Admin\AppData\Local\Temp\d1148eb27cd4476834945fb83c7ee31da59802378cbe1f9dbd42e6a858a234a6.exe
"C:\Users\Admin\AppData\Local\Temp\d1148eb27cd4476834945fb83c7ee31da59802378cbe1f9dbd42e6a858a234a6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 36
  2⤵
  - Program crash
  PID:2820