8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0

Analysis

max time kernel
170s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 14:27

Target

8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0.exe
Size

82KB
MD5

4d6081b99e51352fcfe5ef070a436147
SHA1

3bdd41a49a0ef2d37bfdb9f10b6aff2a60a4aa6f
SHA256

8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0
SHA512

88efa49ede081f40942e8c6933b08c270a1adc4479cf4dbcb8b01ff9ddfbbd87ac9ee054f74e33ce76e1239639d708f4024bc5308ec37078bf074348a36f6411
SSDEEP

1536:MnIYUFrJEWEqEbETtlBNg2nCBknvy/4R/R17CQFa3fu8Bvv2:MIYUFrJL3OGBNgZwvyg5P7C9u8Bvu

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5032	3108	WerFault.exe	78
4896	3108	WerFault.exe	78

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3108	8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0.exe
3108	8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 5032	3108	8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0.exe	82
PID 3108 wrote to memory of 5032	3108	8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0.exe	82
PID 3108 wrote to memory of 5032	3108	8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0.exe	82

C:\Users\Admin\AppData\Local\Temp\8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0.exe
"C:\Users\Admin\AppData\Local\Temp\8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 272
  2⤵
  - Program crash
  PID:5032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 272
  2⤵
  - Program crash
  PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3108 -ip 3108
1⤵
PID:2560