9362a5ac58869edffd62653a968e44776565937562d0aee764da685346a6e6ee

Analysis

max time kernel
186s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 18:50

Target

9362a5ac58869edffd62653a968e44776565937562d0aee764da685346a6e6ee.exe
Size

500KB
MD5

d457cecd20031ad13468fb99e1fae90f
SHA1

8e46ba6c243b9f2bc286137142742a06c8621154
SHA256

9362a5ac58869edffd62653a968e44776565937562d0aee764da685346a6e6ee
SHA512

f051050aa690ac74cd0dec00b5d482fcd4fe8a413bb2ec441280f1bb35b23d5c5365402bae4b91cc85d19bfd3f5d60e12d6a629b5d1aaf5b82694977d059e503
SSDEEP

12288:UPQVw6fnWdnX1ktVWcuAiVqUrxdOzjZ9OvGxFZi5L6Bgc5SPLEpM:UPQV3WlX1egl6jZ9OvGZiQyc5SPLEp

Score

3^/10

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1348	4596	WerFault.exe	81
216	4596	WerFault.exe	81
1908	4596	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 1348	4596	9362a5ac58869edffd62653a968e44776565937562d0aee764da685346a6e6ee.exe	84
PID 4596 wrote to memory of 1348	4596	9362a5ac58869edffd62653a968e44776565937562d0aee764da685346a6e6ee.exe	84
PID 4596 wrote to memory of 1348	4596	9362a5ac58869edffd62653a968e44776565937562d0aee764da685346a6e6ee.exe	84

C:\Users\Admin\AppData\Local\Temp\9362a5ac58869edffd62653a968e44776565937562d0aee764da685346a6e6ee.exe
"C:\Users\Admin\AppData\Local\Temp\9362a5ac58869edffd62653a968e44776565937562d0aee764da685346a6e6ee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 552
  2⤵
  - Program crash
  PID:1348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 552
  2⤵
  - Program crash
  PID:216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 612
  2⤵
  - Program crash
  PID:1908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4596 -ip 4596
1⤵
PID:3392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4596 -ip 4596
1⤵
PID:2716

memory/4596-132-0x000000000080B000-0x0000000000877000-memory.dmp

Filesize
432KB

Download
memory/4596-133-0x0000000000800000-0x0000000000809000-memory.dmp

Filesize
36KB

Download
memory/4596-134-0x000000000080B000-0x0000000000877000-memory.dmp

Filesize
432KB

Download