fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 16:36

Target

fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4.exe
Size

117KB
MD5

73494d224c401b61fb57e0e2dd7d2ac5
SHA1

e4d73fb15c26a798534c588b1e3d668d38842e11
SHA256

fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4
SHA512

58ae4015b6f8a8d344dfaf34a01f9c0a2771104340354594295e9158ee099693f2550f43da7b80ec895d2f16affa451365ef07d70b1a1c74bc2b0bf304340878
SSDEEP

3072:VuzrTIH0dm/ppuKY+NL5q/dDx+jiF9lqBIHoz2zDruy:VuvTIUdezYQLMpx+g9RH22z3

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
4208	4016	WerFault.exe	fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4.exe
1952	4016	WerFault.exe	fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4.exe

description	pid	process	target process
PID 4016 wrote to memory of 4208	4016	fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4.exe	WerFault.exe
PID 4016 wrote to memory of 4208	4016	fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4.exe	WerFault.exe
PID 4016 wrote to memory of 4208	4016	fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4.exe
"C:\Users\Admin\AppData\Local\Temp\fac078c046631cef8b329ce638f6d29dd0fb49c9cb1ef0260239b14682404bd4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 484
2⤵
- Program crash
PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 484
2⤵
- Program crash
PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4016 -ip 4016
1⤵
PID:2000