e9fd5cb2e7dc29b58e3aac31863de9fd098c750d742d200fd6a6c3b7da2223df

Analysis

max time kernel
149s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 16:58

Target

e9fd5cb2e7dc29b58e3aac31863de9fd098c750d742d200fd6a6c3b7da2223df.exe
Size

190KB
MD5

5376699cfc6c2fc1bd14abba93bcdd0d
SHA1

0af5a4ea5ea4ad7d0838d98fec3a25bf629da695
SHA256

e9fd5cb2e7dc29b58e3aac31863de9fd098c750d742d200fd6a6c3b7da2223df
SHA512

aa36d1bf71f0e9e3ab7c52f451a4df4c6f517dd0a6c68dac89163cfd277d97d6f7ea5156394a15d5058676616e4985f8e16f7248fbb9be10e893ad2b4ecaff90
SSDEEP

3072:m7B3DAuocS/28JSA0YITO7LQdhMceV4dl88AHWSJvfk3Gn7KM3oMsGX2XvWEKx:YBkXTAAxb7LwhMc5sNvf5oMsO2FI

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
1232	4772	WerFault.exe	e9fd5cb2e7dc29b58e3aac31863de9fd098c750d742d200fd6a6c3b7da2223df.exe
500	4772	WerFault.exe	e9fd5cb2e7dc29b58e3aac31863de9fd098c750d742d200fd6a6c3b7da2223df.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

e9fd5cb2e7dc29b58e3aac31863de9fd098c750d742d200fd6a6c3b7da2223df.exe

description	pid	process	target process
PID 4772 wrote to memory of 1232	4772	e9fd5cb2e7dc29b58e3aac31863de9fd098c750d742d200fd6a6c3b7da2223df.exe	WerFault.exe
PID 4772 wrote to memory of 1232	4772	e9fd5cb2e7dc29b58e3aac31863de9fd098c750d742d200fd6a6c3b7da2223df.exe	WerFault.exe
PID 4772 wrote to memory of 1232	4772	e9fd5cb2e7dc29b58e3aac31863de9fd098c750d742d200fd6a6c3b7da2223df.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e9fd5cb2e7dc29b58e3aac31863de9fd098c750d742d200fd6a6c3b7da2223df.exe
"C:\Users\Admin\AppData\Local\Temp\e9fd5cb2e7dc29b58e3aac31863de9fd098c750d742d200fd6a6c3b7da2223df.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 140
2⤵
- Program crash
PID:1232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 140
2⤵
- Program crash
PID:500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4772 -ip 4772
1⤵
PID:3428