f5f65ae75ffad9fd7ea62cf37e3528c1fcef99739609f9060e28ea74a8e71467

Analysis

max time kernel
38s
max time network
2s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2022 13:50

Target

f5f65ae75ffad9fd7ea62cf37e3528c1fcef99739609f9060e28ea74a8e71467.exe
Size

55KB
MD5

960549c5cf532a425c50e6d1eae3878c
SHA1

3a9e8fa49586e7013bece96495d1af7c0e8f9248
SHA256

f5f65ae75ffad9fd7ea62cf37e3528c1fcef99739609f9060e28ea74a8e71467
SHA512

d364b234fdeb464b662820686cb6b08d66713fcc73333577b2e006353d50fea96a33ba2166c5f9031109dd92a3af74af035e9633db953a45dd2ff7688403d5bc
SSDEEP

768:feYGwsj7eQoJUVOoDKtdP5bBqJRdVPYgNWb4/nKJeOejj+G+9HZ0H:3sXzOo+ZsVzNWb4/i6jG54

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
816	3204	WerFault.exe	76
3600	3204	WerFault.exe	76

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 816	3204	f5f65ae75ffad9fd7ea62cf37e3528c1fcef99739609f9060e28ea74a8e71467.exe	79
PID 3204 wrote to memory of 816	3204	f5f65ae75ffad9fd7ea62cf37e3528c1fcef99739609f9060e28ea74a8e71467.exe	79
PID 3204 wrote to memory of 816	3204	f5f65ae75ffad9fd7ea62cf37e3528c1fcef99739609f9060e28ea74a8e71467.exe	79

C:\Users\Admin\AppData\Local\Temp\f5f65ae75ffad9fd7ea62cf37e3528c1fcef99739609f9060e28ea74a8e71467.exe
"C:\Users\Admin\AppData\Local\Temp\f5f65ae75ffad9fd7ea62cf37e3528c1fcef99739609f9060e28ea74a8e71467.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 280
  2⤵
  - Program crash
  PID:816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 280
  2⤵
  - Program crash
  PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3204 -ip 3204
1⤵
PID:3628