4f0501d47b82348ddb9ccb6be2af5e23eaba210b9632915adb7524178707a1e2

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 21:27

Target

4f0501d47b82348ddb9ccb6be2af5e23eaba210b9632915adb7524178707a1e2.exe
Size

150KB
MD5

45efea6368e9617c88738149f5542c5a
SHA1

961d54c0e911badda0d4a8c2e575fc1003045fe7
SHA256

4f0501d47b82348ddb9ccb6be2af5e23eaba210b9632915adb7524178707a1e2
SHA512

4e53910038d5d27c25a67607992b602b04f9aab6af6dcea4bd66bbd5dbdacef547a416682619afdbee45b7c471ee6d7fd8ce6c7fd4f37211e92a324cd06a4054
SSDEEP

3072:IT4J2bv7sIvu8FJm60EljbD55+RYZm7lg0c3/POX5LPeFN9:XS7sID7ljbDOYB/Ie

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
4532	3916	WerFault.exe	4f0501d47b82348ddb9ccb6be2af5e23eaba210b9632915adb7524178707a1e2.exe
1044	3916	WerFault.exe	4f0501d47b82348ddb9ccb6be2af5e23eaba210b9632915adb7524178707a1e2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

4f0501d47b82348ddb9ccb6be2af5e23eaba210b9632915adb7524178707a1e2.exe

pid process

3916 4f0501d47b82348ddb9ccb6be2af5e23eaba210b9632915adb7524178707a1e2.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

4f0501d47b82348ddb9ccb6be2af5e23eaba210b9632915adb7524178707a1e2.exe

pid process

3916 4f0501d47b82348ddb9ccb6be2af5e23eaba210b9632915adb7524178707a1e2.exe

pid	process
3916	4f0501d47b82348ddb9ccb6be2af5e23eaba210b9632915adb7524178707a1e2.exe

pid	process
3916	4f0501d47b82348ddb9ccb6be2af5e23eaba210b9632915adb7524178707a1e2.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

4f0501d47b82348ddb9ccb6be2af5e23eaba210b9632915adb7524178707a1e2.exe

description	pid	process	target process
PID 3916 wrote to memory of 4532	3916	4f0501d47b82348ddb9ccb6be2af5e23eaba210b9632915adb7524178707a1e2.exe	WerFault.exe
PID 3916 wrote to memory of 4532	3916	4f0501d47b82348ddb9ccb6be2af5e23eaba210b9632915adb7524178707a1e2.exe	WerFault.exe
PID 3916 wrote to memory of 4532	3916	4f0501d47b82348ddb9ccb6be2af5e23eaba210b9632915adb7524178707a1e2.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 452
2⤵
- Program crash
PID:4532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 452
2⤵
- Program crash
PID:1044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3916 -ip 3916
1⤵
PID:3900

memory/3916-132-0x0000000002270000-0x0000000002274000-memory.dmp

Filesize
16KB

Download
memory/3916-133-0x0000000002280000-0x000000000229D000-memory.dmp

Filesize
116KB

Download
memory/3916-134-0x0000000002270000-0x0000000002274000-memory.dmp

Filesize
16KB

Download
memory/4532-135-0x0000000000000000-mapping.dmp

Download