8a128f5122d32a4d6780644a13d3ac81cd85895ca025c5fb6e8bb12e94aa5f94

Analysis

max time kernel
199s
max time network
268s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 08:25

Target

8a128f5122d32a4d6780644a13d3ac81cd85895ca025c5fb6e8bb12e94aa5f94.exe
Size

703KB
MD5

521bd488a5de44d84e9d145d3eb8a238
SHA1

a9086094ba2eaa8dc6ff046788ccd441136ad692
SHA256

8a128f5122d32a4d6780644a13d3ac81cd85895ca025c5fb6e8bb12e94aa5f94
SHA512

e34ca05dca5745ba7e38f7414ce5c14407e31e28a3653408be5a9db411f4a1ae1c9f6e637d5147198e32c997bcd38698ac50f7397fa0696db039dce0a458f45b
SSDEEP

12288:Eq24RXH8L52vF+k9/WUqWb+6GqOwGhPcb/ruGe/2DUrkVH1:WmX8L5xk9+f6GqpGRcPuGQmPVH

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
484	368	WerFault.exe	8a128f5122d32a4d6780644a13d3ac81cd85895ca025c5fb6e8bb12e94aa5f94.exe
5104	368	WerFault.exe	8a128f5122d32a4d6780644a13d3ac81cd85895ca025c5fb6e8bb12e94aa5f94.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

8a128f5122d32a4d6780644a13d3ac81cd85895ca025c5fb6e8bb12e94aa5f94.exe

description	pid	process	target process
PID 368 wrote to memory of 484	368	8a128f5122d32a4d6780644a13d3ac81cd85895ca025c5fb6e8bb12e94aa5f94.exe	WerFault.exe
PID 368 wrote to memory of 484	368	8a128f5122d32a4d6780644a13d3ac81cd85895ca025c5fb6e8bb12e94aa5f94.exe	WerFault.exe
PID 368 wrote to memory of 484	368	8a128f5122d32a4d6780644a13d3ac81cd85895ca025c5fb6e8bb12e94aa5f94.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8a128f5122d32a4d6780644a13d3ac81cd85895ca025c5fb6e8bb12e94aa5f94.exe
"C:\Users\Admin\AppData\Local\Temp\8a128f5122d32a4d6780644a13d3ac81cd85895ca025c5fb6e8bb12e94aa5f94.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 368 -s 244
  2⤵
  - Program crash
  PID:484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 368 -s 244
  2⤵
  - Program crash
  PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 368 -ip 368
1⤵
PID:980