d16b2547beaa8ae18959c11c2dde5f75c96e000609e74d05562e038fa947d0b4

Analysis

max time kernel
93s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 06:40

Target

d16b2547beaa8ae18959c11c2dde5f75c96e000609e74d05562e038fa947d0b4.exe
Size

49KB
MD5

6b81963580c9a66b988ddc7604163c30
SHA1

49da25c147fbe8fa19889b459911ae1b369ef0e9
SHA256

d16b2547beaa8ae18959c11c2dde5f75c96e000609e74d05562e038fa947d0b4
SHA512

c4762f02bce7c1299a35a0e234abf05b753bb82fa63e719c7b31af0e1d7a6e8d0cda317332f59be8064a684fbab45d8331a5e8067b7f08dd853c6c5c57d44543
SSDEEP

768:Z1XphQ3B+alRUKRBBYbB1RipwHvEjtE2:fpsp6gB6bB1Rpy

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4548	4868	WerFault.exe	81
4888	4868	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 4548	4868	d16b2547beaa8ae18959c11c2dde5f75c96e000609e74d05562e038fa947d0b4.exe	84
PID 4868 wrote to memory of 4548	4868	d16b2547beaa8ae18959c11c2dde5f75c96e000609e74d05562e038fa947d0b4.exe	84
PID 4868 wrote to memory of 4548	4868	d16b2547beaa8ae18959c11c2dde5f75c96e000609e74d05562e038fa947d0b4.exe	84

C:\Users\Admin\AppData\Local\Temp\d16b2547beaa8ae18959c11c2dde5f75c96e000609e74d05562e038fa947d0b4.exe
"C:\Users\Admin\AppData\Local\Temp\d16b2547beaa8ae18959c11c2dde5f75c96e000609e74d05562e038fa947d0b4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 188
  2⤵
  - Program crash
  PID:4548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 188
  2⤵
  - Program crash
  PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4868 -ip 4868
1⤵
PID:4456