4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f

Analysis

max time kernel
190s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 01:08

Target

4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f.exe
Size

299KB
MD5

43217b2d42063459210ad558ef7295d0
SHA1

f55fd2219558598e2e2c2af839206e65c4dcdd72
SHA256

4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f
SHA512

289dc0976b48eca74fc48f124759869f47b3c263369f5000a3dd60fad895b56ea796521b41e3c6aa24b9f29415a5b4e4d87d00cc06a05ca185d3711c79a98c05
SSDEEP

6144:KXr+lex5gfzDVlVXg7OJsZcbYKSXxIN84:ix5GpXA8YKEE8

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
3380	3580	WerFault.exe	4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f.exe
1984	3580	WerFault.exe	4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f.exe

description	pid	process	target process
PID 3580 wrote to memory of 3380	3580	4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f.exe	WerFault.exe
PID 3580 wrote to memory of 3380	3580	4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f.exe	WerFault.exe
PID 3580 wrote to memory of 3380	3580	4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f.exe
"C:\Users\Admin\AppData\Local\Temp\4a3cc10574c314b3a5d1654e6d7b053d23e6a22a5b19018db798ce282305154f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 508
2⤵
- Program crash
PID:3380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 508
2⤵
- Program crash
PID:1984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3580 -ip 3580
1⤵
PID:240

memory/3380-133-0x0000000000000000-mapping.dmp

Download
memory/3580-132-0x0000000001000000-0x000000000104F000-memory.dmp

Filesize
316KB

Download
memory/3580-134-0x0000000001000000-0x000000000104F000-memory.dmp

Filesize
316KB

Download