a5404724d83dcd280485e3a941dbcb0354fb13a88174918e76a1c43d81e6daa4

Analysis

max time kernel
113s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 21:05

Target

a5404724d83dcd280485e3a941dbcb0354fb13a88174918e76a1c43d81e6daa4.exe
Size

55KB
MD5

62623f5ff9da6b6f35a4de4a5e3586c0
SHA1

527e0960a07f4fd3d94a97b593919f325b740f72
SHA256

a5404724d83dcd280485e3a941dbcb0354fb13a88174918e76a1c43d81e6daa4
SHA512

4e4d276f0e229a925b6f4ba22eefb0dcbb1cd6d9069d185167d68697035b61dcb38c595baf15e57abb2f06afbae5d7ae428026ec767084b5d3e8ddde9fc56493
SSDEEP

384:mFq8YlJ1Z1spMvD1hAA3WEC6PK1z1LtX0ZFdkaNixdMg1+TEdDAaRIdk:dPfO4t3PPSz5tX2dk2sdMfz2

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5092	4780	WerFault.exe	79
4316	4780	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 5092	4780	a5404724d83dcd280485e3a941dbcb0354fb13a88174918e76a1c43d81e6daa4.exe	82
PID 4780 wrote to memory of 5092	4780	a5404724d83dcd280485e3a941dbcb0354fb13a88174918e76a1c43d81e6daa4.exe	82
PID 4780 wrote to memory of 5092	4780	a5404724d83dcd280485e3a941dbcb0354fb13a88174918e76a1c43d81e6daa4.exe	82

C:\Users\Admin\AppData\Local\Temp\a5404724d83dcd280485e3a941dbcb0354fb13a88174918e76a1c43d81e6daa4.exe
"C:\Users\Admin\AppData\Local\Temp\a5404724d83dcd280485e3a941dbcb0354fb13a88174918e76a1c43d81e6daa4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 188
  2⤵
  - Program crash
  PID:5092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 188
  2⤵
  - Program crash
  PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4780 -ip 4780
1⤵
PID:4936