154b4e55ce1d8ded53d9ab935f83e415c70deb7e02ed81fdbd49a066a3691fa5

Analysis

max time kernel
159s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 19:04

Target

154b4e55ce1d8ded53d9ab935f83e415c70deb7e02ed81fdbd49a066a3691fa5.exe
Size

144KB
MD5

50a8eec99190d235a4b8e3acb775d720
SHA1

806a0c57389af673ecbeb72d7e99e05de739afb9
SHA256

154b4e55ce1d8ded53d9ab935f83e415c70deb7e02ed81fdbd49a066a3691fa5
SHA512

39db5bffc7e1e4f16d6357e2ba3e5e58cbc43dda93ac0e7a6569b9195c342d0255445089f4532bf6ba1d4c9e358d8be9883bc72a2033fb2d23e0901a29652c14
SSDEEP

3072:oR8o3Ci/c5LuZjXgIkag0gvs3bgg2xGnRbND:w/c5LuZkI/UGbgg2xC1

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
1692	1304	WerFault.exe	154b4e55ce1d8ded53d9ab935f83e415c70deb7e02ed81fdbd49a066a3691fa5.exe
2188	1304	WerFault.exe	154b4e55ce1d8ded53d9ab935f83e415c70deb7e02ed81fdbd49a066a3691fa5.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

154b4e55ce1d8ded53d9ab935f83e415c70deb7e02ed81fdbd49a066a3691fa5.exe

description	pid	process	target process
PID 1304 wrote to memory of 1692	1304	154b4e55ce1d8ded53d9ab935f83e415c70deb7e02ed81fdbd49a066a3691fa5.exe	WerFault.exe
PID 1304 wrote to memory of 1692	1304	154b4e55ce1d8ded53d9ab935f83e415c70deb7e02ed81fdbd49a066a3691fa5.exe	WerFault.exe
PID 1304 wrote to memory of 1692	1304	154b4e55ce1d8ded53d9ab935f83e415c70deb7e02ed81fdbd49a066a3691fa5.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\154b4e55ce1d8ded53d9ab935f83e415c70deb7e02ed81fdbd49a066a3691fa5.exe
"C:\Users\Admin\AppData\Local\Temp\154b4e55ce1d8ded53d9ab935f83e415c70deb7e02ed81fdbd49a066a3691fa5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 408
2⤵
- Program crash
PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 408
2⤵
- Program crash
PID:2188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1304 -ip 1304
1⤵
PID:1948

memory/1304-132-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1304-134-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1692-133-0x0000000000000000-mapping.dmp

Download