72e79a19fc521a29c028dbf5a0d16374768183022acba271aa856e2f24ade5ae

Analysis

max time kernel
139s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 22:34

Target

72e79a19fc521a29c028dbf5a0d16374768183022acba271aa856e2f24ade5ae.exe
Size

216KB
MD5

82625a06d857654c4a21c68a447b341c
SHA1

04c0a60e38a898cee28d877be9feffb870b5aeb3
SHA256

72e79a19fc521a29c028dbf5a0d16374768183022acba271aa856e2f24ade5ae
SHA512

e2ee6f17b1389bb02fa7d418ab44470a85604000b8ee682abc03291a8e332c85be39b15c9b169a2d8c53f60f12ea2a61728f5af5c20d71521e1d351f9d198013
SSDEEP

6144:TXhGDY8OfkQ95OO4HCrs3FCsVRBjzxq/sKaHM9:TiY8OMQ95OO1ytrf/K5

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5112	2108	WerFault.exe	80
1828	2108	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 5112	2108	72e79a19fc521a29c028dbf5a0d16374768183022acba271aa856e2f24ade5ae.exe	84
PID 2108 wrote to memory of 5112	2108	72e79a19fc521a29c028dbf5a0d16374768183022acba271aa856e2f24ade5ae.exe	84
PID 2108 wrote to memory of 5112	2108	72e79a19fc521a29c028dbf5a0d16374768183022acba271aa856e2f24ade5ae.exe	84

C:\Users\Admin\AppData\Local\Temp\72e79a19fc521a29c028dbf5a0d16374768183022acba271aa856e2f24ade5ae.exe
"C:\Users\Admin\AppData\Local\Temp\72e79a19fc521a29c028dbf5a0d16374768183022acba271aa856e2f24ade5ae.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 536
  2⤵
  - Program crash
  PID:5112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 536
  2⤵
  - Program crash
  PID:1828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2108 -ip 2108
1⤵
PID:3636