6d109ca24456a6ac985e5ec91c0658f844534cde7cb5c10dac48e48274b7dbd0

Analysis

max time kernel
165s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 06:10

Target

6d109ca24456a6ac985e5ec91c0658f844534cde7cb5c10dac48e48274b7dbd0.exe
Size

805KB
MD5

1ff9e4802dcfc820a64c6c1f0eafd972
SHA1

435518463e53917596e6e3db45669af108699295
SHA256

6d109ca24456a6ac985e5ec91c0658f844534cde7cb5c10dac48e48274b7dbd0
SHA512

3ead1aaecdbf18c460246341e286414b136ee8a17bb3086323348bcbf6d3572963e5a0b6a92ba8950b14447b6013d9532402a7e48a9421611c102d35439801b8
SSDEEP

12288:GM2mnU5hd5LpIQLp5/6n8FQXpOBkGbO+tD5M30Hom44lshs0CaS/6+BUbHe0lg:GAU5h3L6Q88FQwO+De0lldR6+BU7e0lg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4888	2092	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 4708	2092	6d109ca24456a6ac985e5ec91c0658f844534cde7cb5c10dac48e48274b7dbd0.exe	79
PID 2092 wrote to memory of 4708	2092	6d109ca24456a6ac985e5ec91c0658f844534cde7cb5c10dac48e48274b7dbd0.exe	79
PID 2092 wrote to memory of 4708	2092	6d109ca24456a6ac985e5ec91c0658f844534cde7cb5c10dac48e48274b7dbd0.exe	79

C:\Users\Admin\AppData\Local\Temp\6d109ca24456a6ac985e5ec91c0658f844534cde7cb5c10dac48e48274b7dbd0.exe
"C:\Users\Admin\AppData\Local\Temp\6d109ca24456a6ac985e5ec91c0658f844534cde7cb5c10dac48e48274b7dbd0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Users\Admin\AppData\Local\Temp\6d109ca24456a6ac985e5ec91c0658f844534cde7cb5c10dac48e48274b7dbd0.exe
  C:\Users\Admin\AppData\Local\Temp\6d109ca24456a6ac985e5ec91c0658f844534cde7cb5c10dac48e48274b7dbd0.exe
  2⤵
  PID:4708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 428
  2⤵
  - Program crash
  PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2092 -ip 2092
1⤵
PID:3276