0dae2c6c1d47247fbd09a0d5c6f6e9728bec4c6ecb29dcace4a226770ec095f2

Analysis

max time kernel
112s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 16:50

Target

0dae2c6c1d47247fbd09a0d5c6f6e9728bec4c6ecb29dcace4a226770ec095f2.exe
Size

72KB
MD5

a34f00048fdb7ef3ed5860d2f4bfd740
SHA1

3acfce215afd40c75b7ceb3fc6cbb850f617d1d3
SHA256

0dae2c6c1d47247fbd09a0d5c6f6e9728bec4c6ecb29dcace4a226770ec095f2
SHA512

c934269c3605226f57e2c45ecbd1ca06971b450d05878f23b86d4c1be3512f446d0de5134d28910bde0b132e2d8d1276d6dc5f8588471043fce5c0a06665d6ca
SSDEEP

1536:tML+AUTpldYFCuvMuGakmx1ps51aUBRwn48DchYdSQc:tML+AUTpldLukuG41s51Nq48QhYdSQ

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4744	1612	WerFault.exe	81
4928	1612	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 4744	1612	0dae2c6c1d47247fbd09a0d5c6f6e9728bec4c6ecb29dcace4a226770ec095f2.exe	84
PID 1612 wrote to memory of 4744	1612	0dae2c6c1d47247fbd09a0d5c6f6e9728bec4c6ecb29dcace4a226770ec095f2.exe	84
PID 1612 wrote to memory of 4744	1612	0dae2c6c1d47247fbd09a0d5c6f6e9728bec4c6ecb29dcace4a226770ec095f2.exe	84

C:\Users\Admin\AppData\Local\Temp\0dae2c6c1d47247fbd09a0d5c6f6e9728bec4c6ecb29dcace4a226770ec095f2.exe
"C:\Users\Admin\AppData\Local\Temp\0dae2c6c1d47247fbd09a0d5c6f6e9728bec4c6ecb29dcace4a226770ec095f2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 288
  2⤵
  - Program crash
  PID:4744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 288
  2⤵
  - Program crash
  PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1612 -ip 1612
1⤵
PID:4324

memory/1612-132-0x0000000001000000-0x000000000101A000-memory.dmp

Filesize
104KB

Download
memory/1612-134-0x0000000001000000-0x000000000101A000-memory.dmp

Filesize
104KB

Download