d4fb66f4589c88bb982c120067b894714e6daaa7c039d643074ccc671a501381

Analysis

max time kernel
180s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2022, 21:48

Target

d4fb66f4589c88bb982c120067b894714e6daaa7c039d643074ccc671a501381.exe
Size

574KB
MD5

070e6f9b8615caf2b3fc16516b86e770
SHA1

0096391f036c01a4803b3d246ade9c3697c5fe7f
SHA256

d4fb66f4589c88bb982c120067b894714e6daaa7c039d643074ccc671a501381
SHA512

fa055a652eb6251f81f37e37701ff99982c2091ac6f582eefad292fd284a916fbb854990d668d370f75110d59ad60dda94993908bcf4f1674a650411e7bbf217
SSDEEP

12288:i4MIzKOSQ+Ya41oT79xpUKvxBJyiqFEeJgJHDWk26zF4Cz9MEhIDs5:jMLTpPPOEqk2oF4Cz6EhIDs5

Score

3^/10

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2208	2496	WerFault.exe	79
3316	3164	WerFault.exe	85
1688	4736	WerFault.exe	84

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	d4fb66f4589c88bb982c120067b894714e6daaa7c039d643074ccc671a501381.exe

Suspicious use of UnmapMainImage 3 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 4736	2496	d4fb66f4589c88bb982c120067b894714e6daaa7c039d643074ccc671a501381.exe	84
PID 2496 wrote to memory of 4736	2496	d4fb66f4589c88bb982c120067b894714e6daaa7c039d643074ccc671a501381.exe	84
PID 2496 wrote to memory of 4736	2496	d4fb66f4589c88bb982c120067b894714e6daaa7c039d643074ccc671a501381.exe	84
PID 2496 wrote to memory of 3164	2496	d4fb66f4589c88bb982c120067b894714e6daaa7c039d643074ccc671a501381.exe	85
PID 2496 wrote to memory of 3164	2496	d4fb66f4589c88bb982c120067b894714e6daaa7c039d643074ccc671a501381.exe	85
PID 2496 wrote to memory of 3164	2496	d4fb66f4589c88bb982c120067b894714e6daaa7c039d643074ccc671a501381.exe	85

C:\Users\Admin\AppData\Local\Temp\d4fb66f4589c88bb982c120067b894714e6daaa7c039d643074ccc671a501381.exe
"C:\Users\Admin\AppData\Local\Temp\d4fb66f4589c88bb982c120067b894714e6daaa7c039d643074ccc671a501381.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 608
  2⤵
  - Program crash
  PID:2208
- C:\Users\Admin\AppData\Local\Temp\d4fb66f4589c88bb982c120067b894714e6daaa7c039d643074ccc671a501381.exe
  start
  2⤵
  - Modifies registry class
  - Suspicious use of UnmapMainImage
  PID:4736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 564
    3⤵
    - Program crash
    PID:1688
- C:\Users\Admin\AppData\Local\Temp\d4fb66f4589c88bb982c120067b894714e6daaa7c039d643074ccc671a501381.exe
  watch
  2⤵
  - Suspicious use of UnmapMainImage
  PID:3164
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 572
    3⤵
    - Program crash
    PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2496 -ip 2496
1⤵
PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4736 -ip 4736
1⤵
PID:1708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3164 -ip 3164
1⤵
PID:1612

memory/2496-132-0x0000000000640000-0x000000000065F000-memory.dmp

Filesize
124KB

Download
memory/2496-133-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2496-136-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/3164-138-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/3164-140-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/4736-137-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/4736-139-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download