b293204e3b04707cb67984bbd5fe504761155bffd2e865433b6ad8409d9161c3

Analysis

max time kernel
326s
max time network
337s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 07:07

Target

b293204e3b04707cb67984bbd5fe504761155bffd2e865433b6ad8409d9161c3.exe
Size

306KB
MD5

8105d0a3dd2a66e20d828f567b5a9569
SHA1

64892a946dcc960c387e3b4d074989cf4ad153e9
SHA256

b293204e3b04707cb67984bbd5fe504761155bffd2e865433b6ad8409d9161c3
SHA512

9970e523356afdd2e84f32e1b77d4e4d93c0429ada31ad40fd3524e3356bfb958d88cfc919d1ae26e644cda8c6abc636caec1c7d6082b8b2ba1431c7d2eb4051
SSDEEP

6144:IXHEcDthb4m21lyhsOiFD1FS5+w0lwGGc:IXbhz2YI1uklwlc

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2516	4524	WerFault.exe	80
5108	4524	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 2516	4524	b293204e3b04707cb67984bbd5fe504761155bffd2e865433b6ad8409d9161c3.exe	84
PID 4524 wrote to memory of 2516	4524	b293204e3b04707cb67984bbd5fe504761155bffd2e865433b6ad8409d9161c3.exe	84
PID 4524 wrote to memory of 2516	4524	b293204e3b04707cb67984bbd5fe504761155bffd2e865433b6ad8409d9161c3.exe	84

C:\Users\Admin\AppData\Local\Temp\b293204e3b04707cb67984bbd5fe504761155bffd2e865433b6ad8409d9161c3.exe
"C:\Users\Admin\AppData\Local\Temp\b293204e3b04707cb67984bbd5fe504761155bffd2e865433b6ad8409d9161c3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 504
  2⤵
  - Program crash
  PID:2516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 504
  2⤵
  - Program crash
  PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4524 -ip 4524
1⤵
PID:2040

memory/4524-132-0x00000000001F0000-0x000000000023F000-memory.dmp

Filesize
316KB

Download
memory/4524-134-0x00000000001F0000-0x000000000023F000-memory.dmp

Filesize
316KB

Download