2bfb8335b0c4155371b1562571fe69df15a68473ac0b8867b087f5f8132d9f45

Analysis

max time kernel
338s
max time network
416s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 08:09

Target

2bfb8335b0c4155371b1562571fe69df15a68473ac0b8867b087f5f8132d9f45.exe
Size

3.8MB
MD5

5b9f947ba67e1f33fcf4b0ea8a078f96
SHA1

d09125c8de526a4522b6337051842e5c95baf3f8
SHA256

2bfb8335b0c4155371b1562571fe69df15a68473ac0b8867b087f5f8132d9f45
SHA512

1219ec2ed50b25ae4bd4bf22235cce9810827503d80b115b31869038d8e54503d841ccc5d1003d4cc6f9725a677d14218e61697a3cd6514c37a21c0933e23fc5
SSDEEP

98304:1JdA3vl951KgWYBGn3YXUC9YMvFbzbrYC0Xi/71NW:Cj51KmU3Y9+MFzbrK471s

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
4212	5104	WerFault.exe	2bfb8335b0c4155371b1562571fe69df15a68473ac0b8867b087f5f8132d9f45.exe
4480	5104	WerFault.exe	2bfb8335b0c4155371b1562571fe69df15a68473ac0b8867b087f5f8132d9f45.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2bfb8335b0c4155371b1562571fe69df15a68473ac0b8867b087f5f8132d9f45.exe

description	pid	process	target process
PID 5104 wrote to memory of 4212	5104	2bfb8335b0c4155371b1562571fe69df15a68473ac0b8867b087f5f8132d9f45.exe	WerFault.exe
PID 5104 wrote to memory of 4212	5104	2bfb8335b0c4155371b1562571fe69df15a68473ac0b8867b087f5f8132d9f45.exe	WerFault.exe
PID 5104 wrote to memory of 4212	5104	2bfb8335b0c4155371b1562571fe69df15a68473ac0b8867b087f5f8132d9f45.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2bfb8335b0c4155371b1562571fe69df15a68473ac0b8867b087f5f8132d9f45.exe
"C:\Users\Admin\AppData\Local\Temp\2bfb8335b0c4155371b1562571fe69df15a68473ac0b8867b087f5f8132d9f45.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 540
2⤵
- Program crash
PID:4212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 540
2⤵
- Program crash
PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5104 -ip 5104
1⤵
PID:4136

memory/4212-133-0x0000000000000000-mapping.dmp

Download
memory/5104-132-0x0000000003060000-0x0000000003418000-memory.dmp

Filesize
3.7MB

Download