a388eb36391eb64f682f94529901c2b21a05e050d456d24bd6b3bec5d2efa386

Analysis

max time kernel
182s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 21:10

Target

a388eb36391eb64f682f94529901c2b21a05e050d456d24bd6b3bec5d2efa386.exe
Size

140KB
MD5

98422671379e7387f8f579fffcfdf114
SHA1

3434082eff05533dfcda5df2dece69bc82f591d0
SHA256

a388eb36391eb64f682f94529901c2b21a05e050d456d24bd6b3bec5d2efa386
SHA512

34a78c50e79d46238f4dd36c0350a930fda7b86f39b103f695e8597935632f988469846a8af81de10594428067b3d1ecd2c5e4aa13c30c090c2066c123638804
SSDEEP

1536:tSMQBnOOef2HFaDfhLGBrN2PZjjCKuyBemzKL7ojUgfZiGJe8RgmUZY7wZQC8xyP:7z+ladi5N3g7KL7ojjxJewgmsQly

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3112	1752	WerFault.exe	77
4760	1752	WerFault.exe	77

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 3112	1752	a388eb36391eb64f682f94529901c2b21a05e050d456d24bd6b3bec5d2efa386.exe	81
PID 1752 wrote to memory of 3112	1752	a388eb36391eb64f682f94529901c2b21a05e050d456d24bd6b3bec5d2efa386.exe	81
PID 1752 wrote to memory of 3112	1752	a388eb36391eb64f682f94529901c2b21a05e050d456d24bd6b3bec5d2efa386.exe	81

C:\Users\Admin\AppData\Local\Temp\a388eb36391eb64f682f94529901c2b21a05e050d456d24bd6b3bec5d2efa386.exe
"C:\Users\Admin\AppData\Local\Temp\a388eb36391eb64f682f94529901c2b21a05e050d456d24bd6b3bec5d2efa386.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 392
  2⤵
  - Program crash
  PID:3112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 392
  2⤵
  - Program crash
  PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1752 -ip 1752
1⤵
PID:4892

memory/1752-132-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download