568494035ca6efc71af26b35fda4aa2eeee4a6676e281bb0920a44729bf2247e

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 05:05

Target

568494035ca6efc71af26b35fda4aa2eeee4a6676e281bb0920a44729bf2247e.exe
Size

580KB
MD5

19845e4ebbddc0d859fa30fd9254aa4c
SHA1

06c871f485a3424c37f02db9d9e6576740ab44a6
SHA256

568494035ca6efc71af26b35fda4aa2eeee4a6676e281bb0920a44729bf2247e
SHA512

dd4854791ee6462ce7c5083c61ed320e341bb225e72fe616f234ba8c481b8369f58865eba014f1ccb5901b4112e31fca867f3c06fd379087deea33f41da9f05e
SSDEEP

12288:fHyW4yiEHQ1AXkl76VlgIV9NZiGa46cKQdOhCctfM7rBo4Tr:a/MH6AXk58lgw4COh/Wrp

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
836	4864	WerFault.exe	79
1684	4864	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 836	4864	568494035ca6efc71af26b35fda4aa2eeee4a6676e281bb0920a44729bf2247e.exe	82
PID 4864 wrote to memory of 836	4864	568494035ca6efc71af26b35fda4aa2eeee4a6676e281bb0920a44729bf2247e.exe	82
PID 4864 wrote to memory of 836	4864	568494035ca6efc71af26b35fda4aa2eeee4a6676e281bb0920a44729bf2247e.exe	82

C:\Users\Admin\AppData\Local\Temp\568494035ca6efc71af26b35fda4aa2eeee4a6676e281bb0920a44729bf2247e.exe
"C:\Users\Admin\AppData\Local\Temp\568494035ca6efc71af26b35fda4aa2eeee4a6676e281bb0920a44729bf2247e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 404
  2⤵
  - Program crash
  PID:836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 404
  2⤵
  - Program crash
  PID:1684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4864 -ip 4864
1⤵
PID:4760