1d11ab6eddf96f7b8326eb6a4d8a3f898ad7343cfc68e2fe2a18abf7845ae2be

Analysis

max time kernel
126s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 08:15

Target

1d11ab6eddf96f7b8326eb6a4d8a3f898ad7343cfc68e2fe2a18abf7845ae2be.exe
Size

800KB
MD5

62c61030f515b5d33abecb78aa2e7b30
SHA1

1608ad6d98af54878ecc973dc69c66ca4ba3a9b8
SHA256

1d11ab6eddf96f7b8326eb6a4d8a3f898ad7343cfc68e2fe2a18abf7845ae2be
SHA512

cf4e32020e09e0127ea67103a7f1e9d85d8d7f992f3c053a9e9e11ffaa4c35a0c0d1ddf85658620c79108ec0cdd8aa4d879047f05723790af64744d0d8c5295e
SSDEEP

12288:vpL+fgMFoWsqXKXlBuP8QQKlL05feG/9cQpiwWt2rQQ9fkKrtceFvc14Fr8Pd2fK:h6we90QQRfeGSQpVdfVBtvc14FodJR

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3480	5112	WerFault.exe	81
5048	5112	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 3480	5112	1d11ab6eddf96f7b8326eb6a4d8a3f898ad7343cfc68e2fe2a18abf7845ae2be.exe	86
PID 5112 wrote to memory of 3480	5112	1d11ab6eddf96f7b8326eb6a4d8a3f898ad7343cfc68e2fe2a18abf7845ae2be.exe	86
PID 5112 wrote to memory of 3480	5112	1d11ab6eddf96f7b8326eb6a4d8a3f898ad7343cfc68e2fe2a18abf7845ae2be.exe	86

C:\Users\Admin\AppData\Local\Temp\1d11ab6eddf96f7b8326eb6a4d8a3f898ad7343cfc68e2fe2a18abf7845ae2be.exe
"C:\Users\Admin\AppData\Local\Temp\1d11ab6eddf96f7b8326eb6a4d8a3f898ad7343cfc68e2fe2a18abf7845ae2be.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 340
  2⤵
  - Program crash
  PID:3480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 340
  2⤵
  - Program crash
  PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5112 -ip 5112
1⤵
PID:4888