919821626c0514b2a50504cb26a287820996daaa63336522d114b326bebe7c01

Analysis

max time kernel
165s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 17:02

Target

919821626c0514b2a50504cb26a287820996daaa63336522d114b326bebe7c01.exe
Size

161KB
MD5

8606803bf754112331a26315d8f260af
SHA1

e4feb2df9334a6a00d3efd0abcd1dd3d914af34b
SHA256

919821626c0514b2a50504cb26a287820996daaa63336522d114b326bebe7c01
SHA512

3f5eda566a70926269c1644f9eb46f3a3f8a1a6aa17d5db173059366286f8b22c62d8a7959755d435d269c07868b0bb5033c2a5e0b39812b8612a15796343821
SSDEEP

1536:rDbr0hxBnASW9N9TgnJFyxEPikv5XmSzAEEAi2KJIaOhs+QC75lu1cEfEORv/KnS:yn5uNV+J6EJXCAi2o5Yf78fW8d

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2440	1932	WerFault.exe	78
4560	1932	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2440	1932	919821626c0514b2a50504cb26a287820996daaa63336522d114b326bebe7c01.exe	81
PID 1932 wrote to memory of 2440	1932	919821626c0514b2a50504cb26a287820996daaa63336522d114b326bebe7c01.exe	81
PID 1932 wrote to memory of 2440	1932	919821626c0514b2a50504cb26a287820996daaa63336522d114b326bebe7c01.exe	81

C:\Users\Admin\AppData\Local\Temp\919821626c0514b2a50504cb26a287820996daaa63336522d114b326bebe7c01.exe
"C:\Users\Admin\AppData\Local\Temp\919821626c0514b2a50504cb26a287820996daaa63336522d114b326bebe7c01.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 220
  2⤵
  - Program crash
  PID:2440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 220
  2⤵
  - Program crash
  PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1932 -ip 1932
1⤵
PID:4408