33dabc9b66eb3b7365705d212712ea9fb7533b172e094a412b9dca700e78df91

Analysis

max time kernel
129s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2022 18:01

Target

33dabc9b66eb3b7365705d212712ea9fb7533b172e094a412b9dca700e78df91.exe
Size

513KB
MD5

842094aeb41763004028108408365d90
SHA1

062078b23e1aef6c98316648989963ef1bfb43f9
SHA256

33dabc9b66eb3b7365705d212712ea9fb7533b172e094a412b9dca700e78df91
SHA512

623d242cb3a3a88093f50d012dcea7bbf2c485699a0906dc264d422e6efbf7afb29523e70bd975653401bedc8bc77f59286742d40e6e3fac32e654d05268b0ac
SSDEEP

12288:XIBqjHaQba3q4RsxBkRDirQJ/zHQ21tmvurv0oTKRPaGo:XhraQ54RjxiO/zaurcbRPaGo

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1660	1240	WerFault.exe	83
4328	1240	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 1660	1240	33dabc9b66eb3b7365705d212712ea9fb7533b172e094a412b9dca700e78df91.exe	85
PID 1240 wrote to memory of 1660	1240	33dabc9b66eb3b7365705d212712ea9fb7533b172e094a412b9dca700e78df91.exe	85
PID 1240 wrote to memory of 1660	1240	33dabc9b66eb3b7365705d212712ea9fb7533b172e094a412b9dca700e78df91.exe	85

C:\Users\Admin\AppData\Local\Temp\33dabc9b66eb3b7365705d212712ea9fb7533b172e094a412b9dca700e78df91.exe
"C:\Users\Admin\AppData\Local\Temp\33dabc9b66eb3b7365705d212712ea9fb7533b172e094a412b9dca700e78df91.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 388
  2⤵
  - Program crash
  PID:1660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 388
  2⤵
  - Program crash
  PID:4328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1240 -ip 1240
1⤵
PID:380

memory/1240-132-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1240-133-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1660-134-0x0000000000000000-mapping.dmp

Download