d1d6bcb1e318abc7f8bb92d4eb3da9dd78843fa9bf456ceed0cf7bd666387104

Analysis

max time kernel
116s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 21:31

Target

d1d6bcb1e318abc7f8bb92d4eb3da9dd78843fa9bf456ceed0cf7bd666387104.exe
Size

32KB
MD5

b2ea2f3764067ec3c02a4f2bd743e84c
SHA1

43d977a40d925de5c4f06f871321c8ab11587c29
SHA256

d1d6bcb1e318abc7f8bb92d4eb3da9dd78843fa9bf456ceed0cf7bd666387104
SHA512

6e9d21049c35e4f207dbda5c49d0209094bc4cf5963befcc5801f123f38fa67f782893205fc6b8f518e3c65096727581b00b6254e20106935d1c658287c07f01
SSDEEP

384:ccJzZ+EUGfJrh91wx1TznfypnkXlXaIaHtUPMgSru4lujG+47gx:cc5sWJz1wx1TDfy1K1sz7g

Score

3^/10

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2240	1864	WerFault.exe	78
2068	1864	WerFault.exe	78
2032	1864	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 2240	1864	d1d6bcb1e318abc7f8bb92d4eb3da9dd78843fa9bf456ceed0cf7bd666387104.exe	81
PID 1864 wrote to memory of 2240	1864	d1d6bcb1e318abc7f8bb92d4eb3da9dd78843fa9bf456ceed0cf7bd666387104.exe	81
PID 1864 wrote to memory of 2240	1864	d1d6bcb1e318abc7f8bb92d4eb3da9dd78843fa9bf456ceed0cf7bd666387104.exe	81

C:\Users\Admin\AppData\Local\Temp\d1d6bcb1e318abc7f8bb92d4eb3da9dd78843fa9bf456ceed0cf7bd666387104.exe
"C:\Users\Admin\AppData\Local\Temp\d1d6bcb1e318abc7f8bb92d4eb3da9dd78843fa9bf456ceed0cf7bd666387104.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 448
  2⤵
  - Program crash
  PID:2240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 448
  2⤵
  - Program crash
  PID:2068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 448
  2⤵
  - Program crash
  PID:2032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1864 -ip 1864
1⤵
PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1864 -ip 1864
1⤵
PID:524