ed783759ca2f2c6ed49c54e96c3c25193f7e967c6ac46d7595527ebfc4750434

Analysis

max time kernel
152s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 03:57

Target

ed783759ca2f2c6ed49c54e96c3c25193f7e967c6ac46d7595527ebfc4750434.exe
Size

108KB
MD5

7d1796ab6ac49c558909d0dadb95e130
SHA1

ab2660ef9771524b1021543b69dfcc35cbe71ba0
SHA256

ed783759ca2f2c6ed49c54e96c3c25193f7e967c6ac46d7595527ebfc4750434
SHA512

ef564febdf177bb69d40c2a13b2dbc7cfd7f975298d43a1188179dc1db76cf0de7e5157ff46ff3b7a0688c2d097115405622e134635b2ff99150c7a28a4cdbf3
SSDEEP

1536:Lk1PCXf3l9izMfUBRq/YxiLvxnjXIRXMMGBkyJMjZROYJT3bQghxHCZFNbXIDQgv:Lnf3wRqQxKvxnsRcaCZbXID1C

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4908	4052	WerFault.exe	82
4544	4052	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 4908	4052	ed783759ca2f2c6ed49c54e96c3c25193f7e967c6ac46d7595527ebfc4750434.exe	84
PID 4052 wrote to memory of 4908	4052	ed783759ca2f2c6ed49c54e96c3c25193f7e967c6ac46d7595527ebfc4750434.exe	84
PID 4052 wrote to memory of 4908	4052	ed783759ca2f2c6ed49c54e96c3c25193f7e967c6ac46d7595527ebfc4750434.exe	84

C:\Users\Admin\AppData\Local\Temp\ed783759ca2f2c6ed49c54e96c3c25193f7e967c6ac46d7595527ebfc4750434.exe
"C:\Users\Admin\AppData\Local\Temp\ed783759ca2f2c6ed49c54e96c3c25193f7e967c6ac46d7595527ebfc4750434.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 296
  2⤵
  - Program crash
  PID:4908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 296
  2⤵
  - Program crash
  PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4052 -ip 4052
1⤵
PID:4716

memory/4052-132-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4052-134-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download