9f043c55fadf4dcf93c4e2b133c955a033960bfc9b815eb95becd85dd6168c4c

Analysis

max time kernel
334s
max time network
379s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 04:29

Target

9f043c55fadf4dcf93c4e2b133c955a033960bfc9b815eb95becd85dd6168c4c.exe
Size

185KB
MD5

b88f5068493d52e3a5fc1054048daae2
SHA1

82b7371aaa8e96f4ea4f132de5a77e4bca09bd71
SHA256

9f043c55fadf4dcf93c4e2b133c955a033960bfc9b815eb95becd85dd6168c4c
SHA512

7064be9749effda4ea464b3939550990cca732971fbec5df46ce6932fe0fa7aab660efd6a004fa4806c902f9b473f2c790889258262cc41c494374c418d2a245
SSDEEP

3072:3ar0meAs22kChLmrRvDB1R1hFYetoFspICx9OQp7bXXVKcm0anNtIB3flcTIB5h:360db2DChmrVND15pIC9OQp7TIcKNtOD

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1064	1388	WerFault.exe	78
2660	1388	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1064	1388	9f043c55fadf4dcf93c4e2b133c955a033960bfc9b815eb95becd85dd6168c4c.exe	83
PID 1388 wrote to memory of 1064	1388	9f043c55fadf4dcf93c4e2b133c955a033960bfc9b815eb95becd85dd6168c4c.exe	83
PID 1388 wrote to memory of 1064	1388	9f043c55fadf4dcf93c4e2b133c955a033960bfc9b815eb95becd85dd6168c4c.exe	83

C:\Users\Admin\AppData\Local\Temp\9f043c55fadf4dcf93c4e2b133c955a033960bfc9b815eb95becd85dd6168c4c.exe
"C:\Users\Admin\AppData\Local\Temp\9f043c55fadf4dcf93c4e2b133c955a033960bfc9b815eb95becd85dd6168c4c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 388
  2⤵
  - Program crash
  PID:1064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 388
  2⤵
  - Program crash
  PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1388 -ip 1388
1⤵
PID:1532