8d4f89ba41cfd0392416b1bf5298c6560dd75b5cf7c915681c891765be9aa456

Analysis

max time kernel
140s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2022, 18:04

Target

8d4f89ba41cfd0392416b1bf5298c6560dd75b5cf7c915681c891765be9aa456.exe
Size

123KB
MD5

002830482b8a8600d3762e46ac8fcd4c
SHA1

ed74ae046db815a9ec72fffeee3c049053b7e83f
SHA256

8d4f89ba41cfd0392416b1bf5298c6560dd75b5cf7c915681c891765be9aa456
SHA512

8e35063a8765721b65fcb6699b963e5a36676df2754fba77816799bf769af75b8ce93aad8499f9d7a210f753c98be31023602aa95377a0785a827b88b052bcb6
SSDEEP

3072:WwQVbA0j2/3ow9X587cAErIBY3rVTc/2H:lv0C1wY3hTV

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1960	2388	WerFault.exe	65
3472	2388	WerFault.exe	65

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 1960	2388	8d4f89ba41cfd0392416b1bf5298c6560dd75b5cf7c915681c891765be9aa456.exe	84
PID 2388 wrote to memory of 1960	2388	8d4f89ba41cfd0392416b1bf5298c6560dd75b5cf7c915681c891765be9aa456.exe	84
PID 2388 wrote to memory of 1960	2388	8d4f89ba41cfd0392416b1bf5298c6560dd75b5cf7c915681c891765be9aa456.exe	84

C:\Users\Admin\AppData\Local\Temp\8d4f89ba41cfd0392416b1bf5298c6560dd75b5cf7c915681c891765be9aa456.exe
"C:\Users\Admin\AppData\Local\Temp\8d4f89ba41cfd0392416b1bf5298c6560dd75b5cf7c915681c891765be9aa456.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 540
  2⤵
  - Program crash
  PID:1960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 540
  2⤵
  - Program crash
  PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2388 -ip 2388
1⤵
PID:4964