cb934c633b2c2ae5f747923c2e31caf09d4dd3aa1055c15530fd1f150f6df639

Analysis

max time kernel
169s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:12

Target

cb934c633b2c2ae5f747923c2e31caf09d4dd3aa1055c15530fd1f150f6df639.exe
Size

108KB
MD5

4428fae35f39bc364845bebc59418113
SHA1

3e37b579777a41c724c37aeab883fa0af6b97fcd
SHA256

cb934c633b2c2ae5f747923c2e31caf09d4dd3aa1055c15530fd1f150f6df639
SHA512

f1008ec2362fb6060677fe5e72e0f4df0ae61f28510d36ecd29e8d230104271d851e383245d891364ec6ec23d9bbb0aeedafd93ae394b48c2294e4f3bfe6f410
SSDEEP

1536:cYdcBKiB6oQ7Lh5+sXmNt0ttJPXLq0zTrkC:9dOmoIeZt0XTzToC

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
2832	5004	WerFault.exe	cb934c633b2c2ae5f747923c2e31caf09d4dd3aa1055c15530fd1f150f6df639.exe
548	5004	WerFault.exe	cb934c633b2c2ae5f747923c2e31caf09d4dd3aa1055c15530fd1f150f6df639.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cb934c633b2c2ae5f747923c2e31caf09d4dd3aa1055c15530fd1f150f6df639.exe

description	pid	process	target process
PID 5004 wrote to memory of 2832	5004	cb934c633b2c2ae5f747923c2e31caf09d4dd3aa1055c15530fd1f150f6df639.exe	WerFault.exe
PID 5004 wrote to memory of 2832	5004	cb934c633b2c2ae5f747923c2e31caf09d4dd3aa1055c15530fd1f150f6df639.exe	WerFault.exe
PID 5004 wrote to memory of 2832	5004	cb934c633b2c2ae5f747923c2e31caf09d4dd3aa1055c15530fd1f150f6df639.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\cb934c633b2c2ae5f747923c2e31caf09d4dd3aa1055c15530fd1f150f6df639.exe
"C:\Users\Admin\AppData\Local\Temp\cb934c633b2c2ae5f747923c2e31caf09d4dd3aa1055c15530fd1f150f6df639.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 448
2⤵
- Program crash
PID:2832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 448
2⤵
- Program crash
PID:548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5004 -ip 5004
1⤵
PID:4636

memory/2832-133-0x0000000000000000-mapping.dmp

Download
memory/5004-132-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download