2e881b22ddf122fa472f3f84a83b95d803f35cbb959f9acdf958097a2e476d80

Analysis

max time kernel
153s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 19:12

Target

2e881b22ddf122fa472f3f84a83b95d803f35cbb959f9acdf958097a2e476d80.exe
Size

74KB
MD5

53539222ad200034473224972b1558e6
SHA1

111e4cb801d89726575a21aa63bd780e205bdfe0
SHA256

2e881b22ddf122fa472f3f84a83b95d803f35cbb959f9acdf958097a2e476d80
SHA512

3d0fd730c081428b4823857e0b614b8732539435fabaa0af4db9d81d95825ef072c9063453cee34ed7b3546a25bf666bc266587fccfba9bfabb7f5a159bebebe
SSDEEP

1536:MrUlDSC0WWOm6e6mm/ASwwb5RUUgWAlKjBnRrzj20Yzs9VO6J3Q:k8DTNWOhe69/Xwwb5RUUgJlGFdYzs9HK

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
1868	1312	WerFault.exe	2e881b22ddf122fa472f3f84a83b95d803f35cbb959f9acdf958097a2e476d80.exe
2124	1312	WerFault.exe	2e881b22ddf122fa472f3f84a83b95d803f35cbb959f9acdf958097a2e476d80.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2e881b22ddf122fa472f3f84a83b95d803f35cbb959f9acdf958097a2e476d80.exe

description	pid	process	target process
PID 1312 wrote to memory of 1868	1312	2e881b22ddf122fa472f3f84a83b95d803f35cbb959f9acdf958097a2e476d80.exe	WerFault.exe
PID 1312 wrote to memory of 1868	1312	2e881b22ddf122fa472f3f84a83b95d803f35cbb959f9acdf958097a2e476d80.exe	WerFault.exe
PID 1312 wrote to memory of 1868	1312	2e881b22ddf122fa472f3f84a83b95d803f35cbb959f9acdf958097a2e476d80.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2e881b22ddf122fa472f3f84a83b95d803f35cbb959f9acdf958097a2e476d80.exe
"C:\Users\Admin\AppData\Local\Temp\2e881b22ddf122fa472f3f84a83b95d803f35cbb959f9acdf958097a2e476d80.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 224
2⤵
- Program crash
PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 224
2⤵
- Program crash
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1312 -ip 1312
1⤵
PID:1728