0f2346355c896ab2a262af4585e2d76ce3e4b8b67904d7872e5a5889a65a3a8f

Analysis

max time kernel
369s
max time network
378s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 16:56

Target

0f2346355c896ab2a262af4585e2d76ce3e4b8b67904d7872e5a5889a65a3a8f.exe
Size

356KB
MD5

52ac17cfac3ea3fd761f5d9ba67e3f70
SHA1

19e2a246ec2ae8f57f65ae27ba8a99f197e61e31
SHA256

0f2346355c896ab2a262af4585e2d76ce3e4b8b67904d7872e5a5889a65a3a8f
SHA512

1ea7f97952a45efedfa3e38ade378f3cfa1d7585c1ed1cb60fd0f33106d0a398782ff799403b46aeb928b8eff8afbfc58059151edd2566a679b96f185f830114
SSDEEP

6144:8g27CHbEH4s/0oOerJlvLryvT2HopOUpzo0naGR:8feoH4sMoOe1ljryvrYQPaGR

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
4832	4800	WerFault.exe	0f2346355c896ab2a262af4585e2d76ce3e4b8b67904d7872e5a5889a65a3a8f.exe
332	4800	WerFault.exe	0f2346355c896ab2a262af4585e2d76ce3e4b8b67904d7872e5a5889a65a3a8f.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

0f2346355c896ab2a262af4585e2d76ce3e4b8b67904d7872e5a5889a65a3a8f.exe

description	pid	process	target process
PID 4800 wrote to memory of 4832	4800	0f2346355c896ab2a262af4585e2d76ce3e4b8b67904d7872e5a5889a65a3a8f.exe	WerFault.exe
PID 4800 wrote to memory of 4832	4800	0f2346355c896ab2a262af4585e2d76ce3e4b8b67904d7872e5a5889a65a3a8f.exe	WerFault.exe
PID 4800 wrote to memory of 4832	4800	0f2346355c896ab2a262af4585e2d76ce3e4b8b67904d7872e5a5889a65a3a8f.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0f2346355c896ab2a262af4585e2d76ce3e4b8b67904d7872e5a5889a65a3a8f.exe
"C:\Users\Admin\AppData\Local\Temp\0f2346355c896ab2a262af4585e2d76ce3e4b8b67904d7872e5a5889a65a3a8f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 524
2⤵
- Program crash
PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 524
2⤵
- Program crash
PID:332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4800 -ip 4800
1⤵
PID:4720

memory/4800-132-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4800-134-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4832-133-0x0000000000000000-mapping.dmp

Download