a472ffc862929aeeda3044bde1f3307d00aa1640cf090c3e583903013d3ab298

Analysis

max time kernel
115s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 14:46

Target

a472ffc862929aeeda3044bde1f3307d00aa1640cf090c3e583903013d3ab298.exe
Size

334KB
MD5

5c3c511a4a2ed47be55634bd7b4b2f98
SHA1

30a02d1e582b49babcaeb691a38742d404fb6aba
SHA256

a472ffc862929aeeda3044bde1f3307d00aa1640cf090c3e583903013d3ab298
SHA512

30f7d5f6207d98f316a70afafe59af1550151aaf06bbb76857d9eecea204d460b67a3ca7489ec1bca348baa05952ff334f881b333b18886d23600690835df21f
SSDEEP

6144:RnFGe3LA/XzQK0xRJ82UC0mDdjo5r33Q4085iwOs4XWkgTpSI33Qr2:RnFGe3UPV4RJ82UC0mDWrH9085i3qXQ

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
456	3956	WerFault.exe	81
616	3956	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 616	3956	a472ffc862929aeeda3044bde1f3307d00aa1640cf090c3e583903013d3ab298.exe	85
PID 3956 wrote to memory of 616	3956	a472ffc862929aeeda3044bde1f3307d00aa1640cf090c3e583903013d3ab298.exe	85
PID 3956 wrote to memory of 616	3956	a472ffc862929aeeda3044bde1f3307d00aa1640cf090c3e583903013d3ab298.exe	85

C:\Users\Admin\AppData\Local\Temp\a472ffc862929aeeda3044bde1f3307d00aa1640cf090c3e583903013d3ab298.exe
"C:\Users\Admin\AppData\Local\Temp\a472ffc862929aeeda3044bde1f3307d00aa1640cf090c3e583903013d3ab298.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 504
  2⤵
  - Program crash
  PID:456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 504
  2⤵
  - Program crash
  PID:616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 3956 -ip 3956
1⤵
PID:4968

memory/3956-132-0x0000000000597000-0x000000000059B000-memory.dmp

Filesize
16KB

Download
memory/3956-133-0x00000000005A9000-0x00000000005C1000-memory.dmp

Filesize
96KB

Download
memory/3956-134-0x00000000005A9000-0x00000000005C1000-memory.dmp

Filesize
96KB

Download
memory/3956-135-0x00000000005A9000-0x00000000005C1000-memory.dmp

Filesize
96KB

Download