949e1bd54a5ba5d5bc15e0ba04e7e1881572b3dbcdcaea77ee412bd9dfc2bfb0

Analysis

max time kernel
133s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 22:18

Target

949e1bd54a5ba5d5bc15e0ba04e7e1881572b3dbcdcaea77ee412bd9dfc2bfb0.exe
Size

725KB
MD5

a0d15a3136256025cb9917347b0105b0
SHA1

f6880725c8760a0f20069173ee5486e653b57778
SHA256

949e1bd54a5ba5d5bc15e0ba04e7e1881572b3dbcdcaea77ee412bd9dfc2bfb0
SHA512

449f68b63813e78e773343ce2a88ff4edec3a8c8884167bc3b79c175f8d0468af705c29de07c810380689a12cb05f2da8e921c4df475b52f92bca0ddc7cbd9dc
SSDEEP

12288:9QOMKA5qGIELONIAmDK+43UjFYL2sxBnnFAa/Mp1ESh:9QG4RIhIAmDZpS2EnyZp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5012	4884	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 2224	4884	949e1bd54a5ba5d5bc15e0ba04e7e1881572b3dbcdcaea77ee412bd9dfc2bfb0.exe	82
PID 4884 wrote to memory of 2224	4884	949e1bd54a5ba5d5bc15e0ba04e7e1881572b3dbcdcaea77ee412bd9dfc2bfb0.exe	82
PID 4884 wrote to memory of 2224	4884	949e1bd54a5ba5d5bc15e0ba04e7e1881572b3dbcdcaea77ee412bd9dfc2bfb0.exe	82

C:\Users\Admin\AppData\Local\Temp\949e1bd54a5ba5d5bc15e0ba04e7e1881572b3dbcdcaea77ee412bd9dfc2bfb0.exe
"C:\Users\Admin\AppData\Local\Temp\949e1bd54a5ba5d5bc15e0ba04e7e1881572b3dbcdcaea77ee412bd9dfc2bfb0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Users\Admin\AppData\Local\Temp\949e1bd54a5ba5d5bc15e0ba04e7e1881572b3dbcdcaea77ee412bd9dfc2bfb0.exe
  NRTH
  2⤵
  PID:2224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 444
  2⤵
  - Program crash
  PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4884 -ip 4884
1⤵
PID:4532

C:\Users\Admin\AppData\Local\Temp\949e1bd54a5ba5d5bc15e0ba04e7e1881572b3dbcdcaea77ee412bd9dfc2bfb0NRTH

Filesize
4B

MD5
9134669f44c1af0532f613b7508283c4

SHA1
1c2ac638c61bcdbc434fc74649e281bcb1381da2

SHA256
7273854d0e9b34a60907bdde8293415a0f6edd6b8b1ef3957fcabd584be869a2

SHA512
ada8e9c829abcba64641eb0a937c317e2a81494545eaeac4f909395ee739f8b519e331eed7ff67f5960c18029b1a48906f1bcf438f7e3a1e8c13b78fe8aed232

Download Submit
memory/2224-135-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/2224-136-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/4884-133-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/4884-138-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download