b95931dbc93f04c382f0a24e12fe2a47f58828c1c5aa0a95f87a015133f3a0aa

Analysis

max time kernel
155s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2022 23:41

Target

b95931dbc93f04c382f0a24e12fe2a47f58828c1c5aa0a95f87a015133f3a0aa.exe
Size

77KB
MD5

14a2938d451c32ba53cf4a65a6e8eb1e
SHA1

724f2b607d58268de69d46ad9fe98681b01c7643
SHA256

b95931dbc93f04c382f0a24e12fe2a47f58828c1c5aa0a95f87a015133f3a0aa
SHA512

1c6306ab8ecdd5624acffb1f2a7d7211574ec85240298a829fc9cf9945fac79fa72d77f2944c944d1eb7065694405e5d4eaec8684267c2d0048ee8092d820d03
SSDEEP

1536:eDqr21Ehc/CQZ/uMPEayxNpAHxT9pZ5OAzH9qaQC:eur2Snk/LcayxNSRfZX

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3016	4636	WerFault.exe	80
4240	4636	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 3016	4636	b95931dbc93f04c382f0a24e12fe2a47f58828c1c5aa0a95f87a015133f3a0aa.exe	85
PID 4636 wrote to memory of 3016	4636	b95931dbc93f04c382f0a24e12fe2a47f58828c1c5aa0a95f87a015133f3a0aa.exe	85
PID 4636 wrote to memory of 3016	4636	b95931dbc93f04c382f0a24e12fe2a47f58828c1c5aa0a95f87a015133f3a0aa.exe	85

C:\Users\Admin\AppData\Local\Temp\b95931dbc93f04c382f0a24e12fe2a47f58828c1c5aa0a95f87a015133f3a0aa.exe
"C:\Users\Admin\AppData\Local\Temp\b95931dbc93f04c382f0a24e12fe2a47f58828c1c5aa0a95f87a015133f3a0aa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 248
  2⤵
  - Program crash
  PID:3016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 248
  2⤵
  - Program crash
  PID:4240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4636 -ip 4636
1⤵
PID:3324

memory/4636-132-0x00000000003D0000-0x00000000003E5000-memory.dmp

Filesize
84KB

Download
memory/4636-134-0x00000000003D0000-0x00000000003E5000-memory.dmp

Filesize
84KB

Download