01c9f0d6e299c78f37c36e8a397a8607b65101632b2a2445fdce209257d1196f

Analysis

max time kernel
139s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2022 11:14

Target

01c9f0d6e299c78f37c36e8a397a8607b65101632b2a2445fdce209257d1196f.exe
Size

37KB
MD5

42c18cff1cb25083e3dae6c70ba239c0
SHA1

8f023a38839e54cf661606619627275b61024ac1
SHA256

01c9f0d6e299c78f37c36e8a397a8607b65101632b2a2445fdce209257d1196f
SHA512

8d8b918ef74b82dd68ff79d6d88962e82d66af82dcb6cf5bf22e753f077a423e5bdcc49b418770874562f41ccf2399ef4936a6c9d7f868d23f85a946d83648cc
SSDEEP

384:t9ckB0TqwPqUcglaWp7BvXVIKWwrWI9pQAuAOItzxwjFeTlwS6BncbZGhsGh1CFy:t70TtuWHdIMXQ6O0xwReTlN/bBG+1Dg

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2012	4924	WerFault.exe	81
4768	4924	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 2012	4924	01c9f0d6e299c78f37c36e8a397a8607b65101632b2a2445fdce209257d1196f.exe	85
PID 4924 wrote to memory of 2012	4924	01c9f0d6e299c78f37c36e8a397a8607b65101632b2a2445fdce209257d1196f.exe	85
PID 4924 wrote to memory of 2012	4924	01c9f0d6e299c78f37c36e8a397a8607b65101632b2a2445fdce209257d1196f.exe	85

C:\Users\Admin\AppData\Local\Temp\01c9f0d6e299c78f37c36e8a397a8607b65101632b2a2445fdce209257d1196f.exe
"C:\Users\Admin\AppData\Local\Temp\01c9f0d6e299c78f37c36e8a397a8607b65101632b2a2445fdce209257d1196f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 328
  2⤵
  - Program crash
  PID:2012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 328
  2⤵
  - Program crash
  PID:4768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4924 -ip 4924
1⤵
PID:1092

memory/4924-132-0x0000000001000000-0x0000000001016000-memory.dmp

Filesize
88KB

Download
memory/4924-134-0x0000000001000000-0x0000000001016000-memory.dmp

Filesize
88KB

Download