5896de0dc8b178d58570a7564fa6eb898bd8348b3993a01e48d1e2b15a85116d

Analysis

max time kernel
191s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 16:50

Target

5896de0dc8b178d58570a7564fa6eb898bd8348b3993a01e48d1e2b15a85116d.exe
Size

47KB
MD5

3552d5609c921a87203499f05ab073b5
SHA1

f5a5eb54c1c268a306c607842d7e20e4c5fd3910
SHA256

5896de0dc8b178d58570a7564fa6eb898bd8348b3993a01e48d1e2b15a85116d
SHA512

ab0a267ae3a91f7bdc9b2aae07a9e816931b84dfa8b67cc55707b78cbf6ab703c3cba0840503ccbba37b7a4cb4b19ba2e4a85d6cf3102aef12b67218f0d57da7
SSDEEP

768:KMxkTA919auHOuw0hSE+IQ68miEDNnTStzho9sKXKwffFh8G2bakiju:KMx19bOuPSItZGzhonn38G2bT

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
2452	4696	WerFault.exe	5896de0dc8b178d58570a7564fa6eb898bd8348b3993a01e48d1e2b15a85116d.exe
4196	4696	WerFault.exe	5896de0dc8b178d58570a7564fa6eb898bd8348b3993a01e48d1e2b15a85116d.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

5896de0dc8b178d58570a7564fa6eb898bd8348b3993a01e48d1e2b15a85116d.exe

description	pid	process	target process
PID 4696 wrote to memory of 2452	4696	5896de0dc8b178d58570a7564fa6eb898bd8348b3993a01e48d1e2b15a85116d.exe	WerFault.exe
PID 4696 wrote to memory of 2452	4696	5896de0dc8b178d58570a7564fa6eb898bd8348b3993a01e48d1e2b15a85116d.exe	WerFault.exe
PID 4696 wrote to memory of 2452	4696	5896de0dc8b178d58570a7564fa6eb898bd8348b3993a01e48d1e2b15a85116d.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\5896de0dc8b178d58570a7564fa6eb898bd8348b3993a01e48d1e2b15a85116d.exe
"C:\Users\Admin\AppData\Local\Temp\5896de0dc8b178d58570a7564fa6eb898bd8348b3993a01e48d1e2b15a85116d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 352
  2⤵
  - Program crash
  PID:2452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 352
  2⤵
  - Program crash
  PID:4196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4696 -ip 4696
1⤵
PID:3132

memory/2452-133-0x0000000000000000-mapping.dmp

Download
memory/4696-132-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4696-134-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download