a8a3d5c67349345d5a6f0906cb9da7bf7f8397392717377d14da2785e2559a37

Analysis

max time kernel
287s
max time network
318s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 07:54

Target

a8a3d5c67349345d5a6f0906cb9da7bf7f8397392717377d14da2785e2559a37.exe
Size

784KB
MD5

384457d1ca48161017ad379c6a0ac4e0
SHA1

fff416d61c3a07d130ee6e1c1affbf2d7266f166
SHA256

a8a3d5c67349345d5a6f0906cb9da7bf7f8397392717377d14da2785e2559a37
SHA512

28897bc6d5fa77087b34e4c66a85249cb08596b64845c5e78708482d97c505b8b824e1c7acdafafea4b79a102260ef1e70fc03665f0b981e17e75a7dc28ac05b
SSDEEP

12288:GefX5bxGTsLvx/WvBLlmDLI/wA0qSniuMVGnmjKnRlgqdQ3QCNTL:GUX5dDFWLUkWqSnZMknmMIfr5L

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1736	4460	WerFault.exe	79

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 2560	4460	a8a3d5c67349345d5a6f0906cb9da7bf7f8397392717377d14da2785e2559a37.exe	81
PID 4460 wrote to memory of 2560	4460	a8a3d5c67349345d5a6f0906cb9da7bf7f8397392717377d14da2785e2559a37.exe	81
PID 4460 wrote to memory of 2560	4460	a8a3d5c67349345d5a6f0906cb9da7bf7f8397392717377d14da2785e2559a37.exe	81
PID 4460 wrote to memory of 1736	4460	a8a3d5c67349345d5a6f0906cb9da7bf7f8397392717377d14da2785e2559a37.exe	86
PID 4460 wrote to memory of 1736	4460	a8a3d5c67349345d5a6f0906cb9da7bf7f8397392717377d14da2785e2559a37.exe	86
PID 4460 wrote to memory of 1736	4460	a8a3d5c67349345d5a6f0906cb9da7bf7f8397392717377d14da2785e2559a37.exe	86

C:\Users\Admin\AppData\Local\Temp\a8a3d5c67349345d5a6f0906cb9da7bf7f8397392717377d14da2785e2559a37.exe
"C:\Users\Admin\AppData\Local\Temp\a8a3d5c67349345d5a6f0906cb9da7bf7f8397392717377d14da2785e2559a37.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Users\Admin\AppData\Local\Temp\a8a3d5c67349345d5a6f0906cb9da7bf7f8397392717377d14da2785e2559a37.exe
  C:\Users\Admin\AppData\Local\Temp\a8a3d5c67349345d5a6f0906cb9da7bf7f8397392717377d14da2785e2559a37.exe
  2⤵
  PID:2560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 548
  2⤵
  - Program crash
  PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 4460 -ip 4460
1⤵
PID:1992