da766e4c40715056924f8007ef0509284895586680f5fb646ad13016640b9ac0

Analysis

max time kernel
193s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:57

Target

da766e4c40715056924f8007ef0509284895586680f5fb646ad13016640b9ac0.exe
Size

355KB
MD5

fde77f76d7272baf60f31fbe9f9ccd77
SHA1

9e2657710ca5d0da7212794a4f6bf3288beb1927
SHA256

da766e4c40715056924f8007ef0509284895586680f5fb646ad13016640b9ac0
SHA512

eadadb2da204c0d03d531d4c179999c62c732c3dbc4d67354db5fe966366b2fab1ad5717085ad44a682b6cd46b0f52c47c4ca7d664141cdc5333858a7c1c0dfd
SSDEEP

6144:IAWjwTYAuM89JubmIraDYrqSHsPyBu6JuU+CpDn0H6dIVEwRwsKGEygvxmgksA:ILj9C89dIOybzZJpDSIGT+sKG1

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
4512	2612	WerFault.exe	da766e4c40715056924f8007ef0509284895586680f5fb646ad13016640b9ac0.exe
3884	2612	WerFault.exe	da766e4c40715056924f8007ef0509284895586680f5fb646ad13016640b9ac0.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

da766e4c40715056924f8007ef0509284895586680f5fb646ad13016640b9ac0.exe

description	pid	process	target process
PID 2612 wrote to memory of 4512	2612	da766e4c40715056924f8007ef0509284895586680f5fb646ad13016640b9ac0.exe	WerFault.exe
PID 2612 wrote to memory of 4512	2612	da766e4c40715056924f8007ef0509284895586680f5fb646ad13016640b9ac0.exe	WerFault.exe
PID 2612 wrote to memory of 4512	2612	da766e4c40715056924f8007ef0509284895586680f5fb646ad13016640b9ac0.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\da766e4c40715056924f8007ef0509284895586680f5fb646ad13016640b9ac0.exe
"C:\Users\Admin\AppData\Local\Temp\da766e4c40715056924f8007ef0509284895586680f5fb646ad13016640b9ac0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 508
2⤵
- Program crash
PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 508
2⤵
- Program crash
PID:3884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2612 -ip 2612
1⤵
PID:1176