18175bc1f3a7984661c31fe2f15a4560f00014c4ba5eda7e6c1cd14c8f5f579d

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:15

Target

18175bc1f3a7984661c31fe2f15a4560f00014c4ba5eda7e6c1cd14c8f5f579d.exe
Size

178KB
MD5

29756253923bedb066b4754e8ac76c46
SHA1

48779bf44621ae869d4fa273bce2f579498f9554
SHA256

18175bc1f3a7984661c31fe2f15a4560f00014c4ba5eda7e6c1cd14c8f5f579d
SHA512

11e1437b694dc565c36ff566163c8814a1db3ab70399022fe922d328020e68d22cd259097a956a063df2568762f8e26d1a53758a90cf5fe6ecc8a0e8ba627781
SSDEEP

3072:Ptn44KzldJMLrivtwFoUaOBgjaN+KKIRnz83dmpPNa8BSVdKO4GeXI89CcYg0IUK:F44KzlAi1YoUlBEsvRqdmpPFjt9DiIpR

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1300 1608 WerFault.exe 18175bc1f3a7984661c31fe2f15a4560f00014c4ba5eda7e6c1cd14c8f5f579d.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

18175bc1f3a7984661c31fe2f15a4560f00014c4ba5eda7e6c1cd14c8f5f579d.exe

pid process

1608 18175bc1f3a7984661c31fe2f15a4560f00014c4ba5eda7e6c1cd14c8f5f579d.exe

pid	pid_target	process	target process
1300	1608	WerFault.exe	18175bc1f3a7984661c31fe2f15a4560f00014c4ba5eda7e6c1cd14c8f5f579d.exe

pid	process
1608	18175bc1f3a7984661c31fe2f15a4560f00014c4ba5eda7e6c1cd14c8f5f579d.exe

C:\Users\Admin\AppData\Local\Temp\18175bc1f3a7984661c31fe2f15a4560f00014c4ba5eda7e6c1cd14c8f5f579d.exe
"C:\Users\Admin\AppData\Local\Temp\18175bc1f3a7984661c31fe2f15a4560f00014c4ba5eda7e6c1cd14c8f5f579d.exe"
1⤵
- Suspicious use of UnmapMainImage
PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 536
2⤵
- Program crash
PID:1300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1608 -ip 1608
1⤵
PID:632

memory/1608-132-0x0000000002180000-0x0000000002191000-memory.dmp

Filesize
68KB

Download
memory/1608-133-0x00000000021A0000-0x00000000021C3000-memory.dmp

Filesize
140KB

Download