a8e96f273b0d832669d367d43ccd4b55c34a459a6ff65dcac417e5be40b5c7ac

Analysis

max time kernel
198s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 23:02

Target

a8e96f273b0d832669d367d43ccd4b55c34a459a6ff65dcac417e5be40b5c7ac.exe
Size

746KB
MD5

195016e5c753eba8fdc25fc8064458a3
SHA1

e1d72f246bfa7a2e4297879b359ace36a07d8a6a
SHA256

a8e96f273b0d832669d367d43ccd4b55c34a459a6ff65dcac417e5be40b5c7ac
SHA512

54c4b51bfcd7265413bafd556a2a2bf8cdf96aea07d66ad1e633f2534ce941420a3b3d7e8022615402c984e92689ffaa1e1b72478c6dd5b8d162f52a8ccea268
SSDEEP

12288:XDjJGcVlJ1XlNCwc1cHFUi18Wihq/KTXOViIHRLAA3uj7S0gzWIN2b2fEmbuLRjW:X5x2wMYUu/5iIxtmzYW6cmCW

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4144	1020	WerFault.exe	83
3500	1020	WerFault.exe	83

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 3244	1020	a8e96f273b0d832669d367d43ccd4b55c34a459a6ff65dcac417e5be40b5c7ac.exe	84
PID 1020 wrote to memory of 3244	1020	a8e96f273b0d832669d367d43ccd4b55c34a459a6ff65dcac417e5be40b5c7ac.exe	84
PID 1020 wrote to memory of 3244	1020	a8e96f273b0d832669d367d43ccd4b55c34a459a6ff65dcac417e5be40b5c7ac.exe	84
PID 1020 wrote to memory of 4144	1020	a8e96f273b0d832669d367d43ccd4b55c34a459a6ff65dcac417e5be40b5c7ac.exe	86
PID 1020 wrote to memory of 4144	1020	a8e96f273b0d832669d367d43ccd4b55c34a459a6ff65dcac417e5be40b5c7ac.exe	86
PID 1020 wrote to memory of 4144	1020	a8e96f273b0d832669d367d43ccd4b55c34a459a6ff65dcac417e5be40b5c7ac.exe	86

C:\Users\Admin\AppData\Local\Temp\a8e96f273b0d832669d367d43ccd4b55c34a459a6ff65dcac417e5be40b5c7ac.exe
"C:\Users\Admin\AppData\Local\Temp\a8e96f273b0d832669d367d43ccd4b55c34a459a6ff65dcac417e5be40b5c7ac.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Users\Admin\AppData\Local\Temp\a8e96f273b0d832669d367d43ccd4b55c34a459a6ff65dcac417e5be40b5c7ac.exe
  C:\Users\Admin\AppData\Local\Temp\a8e96f273b0d832669d367d43ccd4b55c34a459a6ff65dcac417e5be40b5c7ac.exe
  2⤵
  PID:3244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 428
  2⤵
  - Program crash
  PID:4144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 428
  2⤵
  - Program crash
  PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1020 -ip 1020
1⤵
PID:3652