5b689d04c37b221fb03e4957edc64bf3a8fa7762a42b5257a64ed86f9e182c4b

Analysis

max time kernel
147s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2022 23:55

Target

5b689d04c37b221fb03e4957edc64bf3a8fa7762a42b5257a64ed86f9e182c4b.exe
Size

383KB
MD5

02a65851ad053ac7dcd6d5356b3f98a2
SHA1

86cbe36bb6c5e457af6f4e8612debed8fe705a6c
SHA256

5b689d04c37b221fb03e4957edc64bf3a8fa7762a42b5257a64ed86f9e182c4b
SHA512

5f7993a27a512cf469db62f45ffab7c30aaf9103549ddc2402e33ae5ea7cb144f1e8aa6515b85ca8ebc77d0825ed551a175cb0077f7bf4dad0ccf06cf93828bf

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
4772	400	WerFault.exe	23
3024	400	WerFault.exe	23

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

5b689d04c37b221fb03e4957edc64bf3a8fa7762a42b5257a64ed86f9e182c4b.exe

description	pid	Process	procid_target
PID 400 wrote to memory of 4772	400	5b689d04c37b221fb03e4957edc64bf3a8fa7762a42b5257a64ed86f9e182c4b.exe	91
PID 400 wrote to memory of 4772	400	5b689d04c37b221fb03e4957edc64bf3a8fa7762a42b5257a64ed86f9e182c4b.exe	91
PID 400 wrote to memory of 4772	400	5b689d04c37b221fb03e4957edc64bf3a8fa7762a42b5257a64ed86f9e182c4b.exe	91

C:\Users\Admin\AppData\Local\Temp\5b689d04c37b221fb03e4957edc64bf3a8fa7762a42b5257a64ed86f9e182c4b.exe
"C:\Users\Admin\AppData\Local\Temp\5b689d04c37b221fb03e4957edc64bf3a8fa7762a42b5257a64ed86f9e182c4b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 564
  2⤵
  - Program crash
  PID:4772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 564
  2⤵
  - Program crash
  PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 400 -ip 400
1⤵
PID:3472

memory/400-132-0x0000000002520000-0x000000000254E000-memory.dmp

Filesize
184KB

Download
memory/4772-133-0x0000000000000000-mapping.dmp

Download