0ebd52fde2e7dc10376ed4ca81ca6bc994bbca0c7de62dc9a151d67f48060540

Analysis

max time kernel
267s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:52

Target

0ebd52fde2e7dc10376ed4ca81ca6bc994bbca0c7de62dc9a151d67f48060540.exe
Size

63KB
MD5

64909a75d488bda5989ac1425a044b4e
SHA1

6e22fa1be588cc11a55050a5b725191777480351
SHA256

0ebd52fde2e7dc10376ed4ca81ca6bc994bbca0c7de62dc9a151d67f48060540
SHA512

1e4a7ca01ba751929b35cec778d67cbf0817d133e291fcb545d1cbad4969a0b3ca18059419e3d3fd928755c2c3141b1519e9ae1a2eafdd155a92f0f2f3f24a61
SSDEEP

768:cyyRGKjXAqn2gZzvIjSnPyPxZqKqEAh9RKTuxOn5BWGrJ95HXCs7vOsUDfXtV14g:cU+fZNGzIvKWOn3v35HqBV14

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
1436	3516	WerFault.exe	0ebd52fde2e7dc10376ed4ca81ca6bc994bbca0c7de62dc9a151d67f48060540.exe
4532	3516	WerFault.exe	0ebd52fde2e7dc10376ed4ca81ca6bc994bbca0c7de62dc9a151d67f48060540.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

0ebd52fde2e7dc10376ed4ca81ca6bc994bbca0c7de62dc9a151d67f48060540.exe

description	pid	process	target process
PID 3516 wrote to memory of 1436	3516	0ebd52fde2e7dc10376ed4ca81ca6bc994bbca0c7de62dc9a151d67f48060540.exe	WerFault.exe
PID 3516 wrote to memory of 1436	3516	0ebd52fde2e7dc10376ed4ca81ca6bc994bbca0c7de62dc9a151d67f48060540.exe	WerFault.exe
PID 3516 wrote to memory of 1436	3516	0ebd52fde2e7dc10376ed4ca81ca6bc994bbca0c7de62dc9a151d67f48060540.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0ebd52fde2e7dc10376ed4ca81ca6bc994bbca0c7de62dc9a151d67f48060540.exe
"C:\Users\Admin\AppData\Local\Temp\0ebd52fde2e7dc10376ed4ca81ca6bc994bbca0c7de62dc9a151d67f48060540.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 284
2⤵
- Program crash
PID:1436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 284
2⤵
- Program crash
PID:4532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3516 -ip 3516
1⤵
PID:2756