99a2c50d98e118f14cd53612e942c038a9e5d9206f59b147826480dfaac1854d

Analysis

max time kernel
179s
max time network
242s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 08:46

Target

99a2c50d98e118f14cd53612e942c038a9e5d9206f59b147826480dfaac1854d.exe
Size

402KB
MD5

98fa5b5c55043957768a15a00b6664cb
SHA1

9ca8cbdfd69a3360a07c763ad1688f92e1f84f08
SHA256

99a2c50d98e118f14cd53612e942c038a9e5d9206f59b147826480dfaac1854d
SHA512

3516b8177b95191872744526bab4a9f74c46e346ddfa77a9e09a589e62c6482bebca2bbd9b0d820708afa87e82fd2dd57de4a9284d33dd9ea086ef1d18b4f28b
SSDEEP

12288:YTaZ2MfAdcl/Z4JVBz+1xbh831RYDrFaZ:YTaZ5A+l/Z4PBz+1xbh83wfYZ

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4444	4748	WerFault.exe	80
1356	4748	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 4444	4748	99a2c50d98e118f14cd53612e942c038a9e5d9206f59b147826480dfaac1854d.exe	85
PID 4748 wrote to memory of 4444	4748	99a2c50d98e118f14cd53612e942c038a9e5d9206f59b147826480dfaac1854d.exe	85
PID 4748 wrote to memory of 4444	4748	99a2c50d98e118f14cd53612e942c038a9e5d9206f59b147826480dfaac1854d.exe	85

C:\Users\Admin\AppData\Local\Temp\99a2c50d98e118f14cd53612e942c038a9e5d9206f59b147826480dfaac1854d.exe
"C:\Users\Admin\AppData\Local\Temp\99a2c50d98e118f14cd53612e942c038a9e5d9206f59b147826480dfaac1854d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 536
  2⤵
  - Program crash
  PID:4444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 536
  2⤵
  - Program crash
  PID:1356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4748 -ip 4748
1⤵
PID:3184

memory/4748-132-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/4748-133-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/4748-135-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download