6308108c97ec2990790ee142b1ed3dc48ba56124918073cc6618f38ab460d595

Analysis

max time kernel
185s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 03:56

Target

6308108c97ec2990790ee142b1ed3dc48ba56124918073cc6618f38ab460d595.exe
Size

410KB
MD5

37d42ca21615a2cd5b15b2d4a5d154cd
SHA1

98f2debcdcf365a9a13b0f149cd573389653371b
SHA256

6308108c97ec2990790ee142b1ed3dc48ba56124918073cc6618f38ab460d595
SHA512

07f67aec1a3fbd9ad12bb9d2a00e4c647f9347399aae98180fcaa179ec3f934ceaf78d1c9dc4f87a2c83a67252c0d390043b038bca0518c8e9f56d1a36777d9f
SSDEEP

6144:ci+ZXt7B0BvqvWqG2P1vPSzrZGe3BmwxRBO3ocaTQsSvFCCLoQlvHoKekDRvRY/:cjXRB0hFf2JazbNvs2WCCdhlRCcRfj

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4540	5008	WerFault.exe	81
4560	5008	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 4540	5008	6308108c97ec2990790ee142b1ed3dc48ba56124918073cc6618f38ab460d595.exe	84
PID 5008 wrote to memory of 4540	5008	6308108c97ec2990790ee142b1ed3dc48ba56124918073cc6618f38ab460d595.exe	84
PID 5008 wrote to memory of 4540	5008	6308108c97ec2990790ee142b1ed3dc48ba56124918073cc6618f38ab460d595.exe	84

C:\Users\Admin\AppData\Local\Temp\6308108c97ec2990790ee142b1ed3dc48ba56124918073cc6618f38ab460d595.exe
"C:\Users\Admin\AppData\Local\Temp\6308108c97ec2990790ee142b1ed3dc48ba56124918073cc6618f38ab460d595.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 328
  2⤵
  - Program crash
  PID:4540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 328
  2⤵
  - Program crash
  PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5008 -ip 5008
1⤵
PID:4092