15615cd374f297670fabe9c1e6aaa30da14783045ca0a5e705ce6946ce0dc377

Analysis

max time kernel
167s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 05:20

Target

15615cd374f297670fabe9c1e6aaa30da14783045ca0a5e705ce6946ce0dc377.exe
Size

202KB
MD5

311a37600cd46d22d51096e5ec3988f8
SHA1

a556a5ed3f9fa612a2757d214989dbab2e8be335
SHA256

15615cd374f297670fabe9c1e6aaa30da14783045ca0a5e705ce6946ce0dc377
SHA512

2be95b77b1ffd19f4139e7aba0462eec411c9f2efdd50efa7ebec673bbf4a9e78c31f941e81aa20c1ed3ca9d1a78e70604fcda1c6924ef9356f5d681fe85cea6
SSDEEP

3072:LKSZ1NhopFyZeA+xOkpiPVJq2AmRyggbQ0JbrM1QmzScIt7iByCxjpBHwyGPr:upzyn2sVHyggbQwrUtmn7iByfy8

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4996	2152	WerFault.exe	82
2632	2152	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 4996	2152	15615cd374f297670fabe9c1e6aaa30da14783045ca0a5e705ce6946ce0dc377.exe	85
PID 2152 wrote to memory of 4996	2152	15615cd374f297670fabe9c1e6aaa30da14783045ca0a5e705ce6946ce0dc377.exe	85
PID 2152 wrote to memory of 4996	2152	15615cd374f297670fabe9c1e6aaa30da14783045ca0a5e705ce6946ce0dc377.exe	85

C:\Users\Admin\AppData\Local\Temp\15615cd374f297670fabe9c1e6aaa30da14783045ca0a5e705ce6946ce0dc377.exe
"C:\Users\Admin\AppData\Local\Temp\15615cd374f297670fabe9c1e6aaa30da14783045ca0a5e705ce6946ce0dc377.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 264
  2⤵
  - Program crash
  PID:4996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 264
  2⤵
  - Program crash
  PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2152 -ip 2152
1⤵
PID:4868

memory/2152-133-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download