415cf2333734857def103f8f15de3091bd115454b787c118aabd763b6d3d125e

Analysis

max time kernel
173s
max time network
212s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 02:32

Target

415cf2333734857def103f8f15de3091bd115454b787c118aabd763b6d3d125e.exe
Size

32KB
MD5

325fffeb14c48b7bc8a680b640307682
SHA1

a86d2020661fc3c98fa43a9578aad227311453cb
SHA256

415cf2333734857def103f8f15de3091bd115454b787c118aabd763b6d3d125e
SHA512

b91b9f38fb2a2e79a5252a22710d83742f39595b1666c80fc29624452756ad4e2856cb805cbbad58cda28ad38261d4de64ba1da67728ccfd762405feece82737
SSDEEP

768:c6R9xrFXHDnwZUszq0hRX6cmO1Sg5sX3M0sXn:c67xr5HDwZUARXV/SHM0c

Score

3^/10

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3792	440	WerFault.exe	81
3176	440	WerFault.exe	81
3536	440	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 3176	440	415cf2333734857def103f8f15de3091bd115454b787c118aabd763b6d3d125e.exe	84
PID 440 wrote to memory of 3176	440	415cf2333734857def103f8f15de3091bd115454b787c118aabd763b6d3d125e.exe	84
PID 440 wrote to memory of 3176	440	415cf2333734857def103f8f15de3091bd115454b787c118aabd763b6d3d125e.exe	84

C:\Users\Admin\AppData\Local\Temp\415cf2333734857def103f8f15de3091bd115454b787c118aabd763b6d3d125e.exe
"C:\Users\Admin\AppData\Local\Temp\415cf2333734857def103f8f15de3091bd115454b787c118aabd763b6d3d125e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 672
  2⤵
  - Program crash
  PID:3792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 672
  2⤵
  - Program crash
  PID:3176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 684
  2⤵
  - Program crash
  PID:3536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 440 -ip 440
1⤵
PID:1244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 440 -ip 440
1⤵
PID:228