906bbd0da1b72f95b541acdabb08026b823ac0871f2d8011ef138228c9107a6d

Analysis

max time kernel
270s
max time network
287s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:57

Target

906bbd0da1b72f95b541acdabb08026b823ac0871f2d8011ef138228c9107a6d.exe
Size

339KB
MD5

5321a5fe0c244f01683c658f452130f0
SHA1

9d8fcaaf1be3127299e07f1cdf8ba215dd2f21a8
SHA256

906bbd0da1b72f95b541acdabb08026b823ac0871f2d8011ef138228c9107a6d
SHA512

bb12c337f1c9195d4b2e6d0c6ed083a6368b21955203d0e66446d0599df6d49fa43ab47e960c176355349185e046cc5a713da1844a070a2cdc8ecf515dc1e095
SSDEEP

6144:AzW/KFKNxY1pDFN0xVI7tRrKwyjg2ruu6rFxpSDg9SCN6Kr:CCxY1djSOBRrKwyjg+uxYUAy6Kr

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

620 1924 WerFault.exe 906bbd0da1b72f95b541acdabb08026b823ac0871f2d8011ef138228c9107a6d.exe

pid	pid_target	process	target process
620	1924	WerFault.exe	906bbd0da1b72f95b541acdabb08026b823ac0871f2d8011ef138228c9107a6d.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

906bbd0da1b72f95b541acdabb08026b823ac0871f2d8011ef138228c9107a6d.exe

description	pid	process	target process
PID 1924 wrote to memory of 620	1924	906bbd0da1b72f95b541acdabb08026b823ac0871f2d8011ef138228c9107a6d.exe	WerFault.exe
PID 1924 wrote to memory of 620	1924	906bbd0da1b72f95b541acdabb08026b823ac0871f2d8011ef138228c9107a6d.exe	WerFault.exe
PID 1924 wrote to memory of 620	1924	906bbd0da1b72f95b541acdabb08026b823ac0871f2d8011ef138228c9107a6d.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\906bbd0da1b72f95b541acdabb08026b823ac0871f2d8011ef138228c9107a6d.exe
"C:\Users\Admin\AppData\Local\Temp\906bbd0da1b72f95b541acdabb08026b823ac0871f2d8011ef138228c9107a6d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 312
2⤵
- Program crash
PID:620

memory/620-133-0x0000000000000000-mapping.dmp

Download
memory/1924-132-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1924-134-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download