c071a1892f1429812ec91aeb825baea9d80fb26044d15d3d575e2fa66335f411

Analysis

max time kernel
176s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 16:40

Target

c071a1892f1429812ec91aeb825baea9d80fb26044d15d3d575e2fa66335f411.exe
Size

132KB
MD5

4301f95ccde79b17532c507874535cf0
SHA1

4092704e7fa81befcbe9d56359bde3014c3f7ac0
SHA256

c071a1892f1429812ec91aeb825baea9d80fb26044d15d3d575e2fa66335f411
SHA512

bf61be44e38314d0ade660870e01564cb2d8b01866e7eca53695798f559f2463ea99fa8b08322e984a8b18f3aa706526e0704f77bf7c593cb86c74900ce10de6
SSDEEP

3072:n0GnBLfORThFfOUBGrFSDADeak7dJHB/A5:08BL2RTv2UB6FSsQLH5A5

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
4576	332	WerFault.exe	c071a1892f1429812ec91aeb825baea9d80fb26044d15d3d575e2fa66335f411.exe
4372	332	WerFault.exe	c071a1892f1429812ec91aeb825baea9d80fb26044d15d3d575e2fa66335f411.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c071a1892f1429812ec91aeb825baea9d80fb26044d15d3d575e2fa66335f411.exe

description	pid	process	target process
PID 332 wrote to memory of 4576	332	c071a1892f1429812ec91aeb825baea9d80fb26044d15d3d575e2fa66335f411.exe	WerFault.exe
PID 332 wrote to memory of 4576	332	c071a1892f1429812ec91aeb825baea9d80fb26044d15d3d575e2fa66335f411.exe	WerFault.exe
PID 332 wrote to memory of 4576	332	c071a1892f1429812ec91aeb825baea9d80fb26044d15d3d575e2fa66335f411.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c071a1892f1429812ec91aeb825baea9d80fb26044d15d3d575e2fa66335f411.exe
"C:\Users\Admin\AppData\Local\Temp\c071a1892f1429812ec91aeb825baea9d80fb26044d15d3d575e2fa66335f411.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 332 -s 408
  2⤵
  - Program crash
  PID:4576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 332 -s 408
  2⤵
  - Program crash
  PID:4372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 332 -ip 332
1⤵
PID:4152

memory/332-132-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/332-134-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4576-133-0x0000000000000000-mapping.dmp

Download