4dc72fc2c7ccfd91d61848c30aac1978d329be7515740dd8436404ac9ffd63fd

Analysis

max time kernel
188s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:22

Target

4dc72fc2c7ccfd91d61848c30aac1978d329be7515740dd8436404ac9ffd63fd.exe
Size

396KB
MD5

3ed79716978bb09c4890a60dd74d5470
SHA1

4b5232a93d4cd129f598ad0fdc93b145faee3922
SHA256

4dc72fc2c7ccfd91d61848c30aac1978d329be7515740dd8436404ac9ffd63fd
SHA512

0aedb190c6f0c5d18c509d57160c79a4c8aa64b5520e1a25d26e3bead94819159895bfa925cd9086f9837f96211d0d9e9bb439d6758b8a20a58a6a030ee527fd
SSDEEP

6144:iX9SMLpHYi2B2plyB86ozFti/2rvpwnIrgc8SwAAwnMNSQNcDPbI/J5EJKdIxj:mL4i2YU2iu7pwQeSBAkAkiJSsY

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
3576	4716	WerFault.exe	4dc72fc2c7ccfd91d61848c30aac1978d329be7515740dd8436404ac9ffd63fd.exe
1504	4716	WerFault.exe	4dc72fc2c7ccfd91d61848c30aac1978d329be7515740dd8436404ac9ffd63fd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

4dc72fc2c7ccfd91d61848c30aac1978d329be7515740dd8436404ac9ffd63fd.exe

pid	process
4716	4dc72fc2c7ccfd91d61848c30aac1978d329be7515740dd8436404ac9ffd63fd.exe
4716	4dc72fc2c7ccfd91d61848c30aac1978d329be7515740dd8436404ac9ffd63fd.exe
4716	4dc72fc2c7ccfd91d61848c30aac1978d329be7515740dd8436404ac9ffd63fd.exe
4716	4dc72fc2c7ccfd91d61848c30aac1978d329be7515740dd8436404ac9ffd63fd.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

4dc72fc2c7ccfd91d61848c30aac1978d329be7515740dd8436404ac9ffd63fd.exe

description	pid	process	target process
PID 4716 wrote to memory of 3576	4716	4dc72fc2c7ccfd91d61848c30aac1978d329be7515740dd8436404ac9ffd63fd.exe	WerFault.exe
PID 4716 wrote to memory of 3576	4716	4dc72fc2c7ccfd91d61848c30aac1978d329be7515740dd8436404ac9ffd63fd.exe	WerFault.exe
PID 4716 wrote to memory of 3576	4716	4dc72fc2c7ccfd91d61848c30aac1978d329be7515740dd8436404ac9ffd63fd.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 228
2⤵
- Program crash
PID:3576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 228
2⤵
- Program crash
PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4716 -ip 4716
1⤵
PID:3960