2d63901b8ca0055cb7965d6b21d0e16d3720d6ef005ff03bffa65b8128cba743

Analysis

max time kernel
162s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 02:51

Target

2d63901b8ca0055cb7965d6b21d0e16d3720d6ef005ff03bffa65b8128cba743.exe
Size

220KB
MD5

6bc4bbc46623bf413a5480eb52e9ff92
SHA1

137e1177b721c5747ef6ef7b26bdbcf31de10702
SHA256

2d63901b8ca0055cb7965d6b21d0e16d3720d6ef005ff03bffa65b8128cba743
SHA512

0f6a1c30ca11065980368000e11e2da563e1f81e8c8afb5265ce879b0739f4d21d83731d8be77f02dcfefcae8d5c01747692701e5830aca0126125b65fed4292
SSDEEP

3072:X/cOuiyzo1EPK7VDtBR5UR5zFc9f0A7NYTQp6BY8wxVR5dLl:vvuxzw3JtVUR3cyA7NYcU2l

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1984	4760	WerFault.exe	78
3272	4760	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 1984	4760	2d63901b8ca0055cb7965d6b21d0e16d3720d6ef005ff03bffa65b8128cba743.exe	82
PID 4760 wrote to memory of 1984	4760	2d63901b8ca0055cb7965d6b21d0e16d3720d6ef005ff03bffa65b8128cba743.exe	82
PID 4760 wrote to memory of 1984	4760	2d63901b8ca0055cb7965d6b21d0e16d3720d6ef005ff03bffa65b8128cba743.exe	82

C:\Users\Admin\AppData\Local\Temp\2d63901b8ca0055cb7965d6b21d0e16d3720d6ef005ff03bffa65b8128cba743.exe
"C:\Users\Admin\AppData\Local\Temp\2d63901b8ca0055cb7965d6b21d0e16d3720d6ef005ff03bffa65b8128cba743.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 296
  2⤵
  - Program crash
  PID:1984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 296
  2⤵
  - Program crash
  PID:3272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4760 -ip 4760
1⤵
PID:4700

memory/4760-132-0x0000000001000000-0x0000000001159000-memory.dmp

Filesize
1.3MB

Download