ae64363e218d348417e17daf329c51b1b7dad6dcb5d072345687381b05627f31

Analysis

max time kernel
147s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 05:21

Target

ae64363e218d348417e17daf329c51b1b7dad6dcb5d072345687381b05627f31.exe
Size

171KB
MD5

3d6b4b820acc44222c658770f35701af
SHA1

0eb736a45150cde25549faf48fde2070da9b88e5
SHA256

ae64363e218d348417e17daf329c51b1b7dad6dcb5d072345687381b05627f31
SHA512

33c277f25f7e9d757e8be57667731f9a813d6429a11cbe5e7517602c2189990aabda5a0a864cdc97a7c9f2ad24ce8abbbb8f6414f6852529b1a9989ba68b8a83
SSDEEP

3072:lDA4sbgkfxE+U/uUISGLL+p0+mjhIlteWd:lXsbhxE+MfcI

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1144	4688	WerFault.exe	81
4888	4688	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 1144	4688	ae64363e218d348417e17daf329c51b1b7dad6dcb5d072345687381b05627f31.exe	84
PID 4688 wrote to memory of 1144	4688	ae64363e218d348417e17daf329c51b1b7dad6dcb5d072345687381b05627f31.exe	84
PID 4688 wrote to memory of 1144	4688	ae64363e218d348417e17daf329c51b1b7dad6dcb5d072345687381b05627f31.exe	84

C:\Users\Admin\AppData\Local\Temp\ae64363e218d348417e17daf329c51b1b7dad6dcb5d072345687381b05627f31.exe
"C:\Users\Admin\AppData\Local\Temp\ae64363e218d348417e17daf329c51b1b7dad6dcb5d072345687381b05627f31.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 284
  2⤵
  - Program crash
  PID:1144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 284
  2⤵
  - Program crash
  PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4688 -ip 4688
1⤵
PID:956