d565025fb421137adfc520c94d9d7fd666b9c76853f433fe796a5ff7c1162e5c

Analysis

max time kernel
158s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 17:02

Target

d565025fb421137adfc520c94d9d7fd666b9c76853f433fe796a5ff7c1162e5c.exe
Size

111KB
MD5

a844c939a91c50be1844854dcaeaf603
SHA1

419262b67d87b14b8f9087147d383035aaef9d1d
SHA256

d565025fb421137adfc520c94d9d7fd666b9c76853f433fe796a5ff7c1162e5c
SHA512

c3094a51ae6bbf4675f16cc7b23a9a621d0a58ec2c08d315f0347d7f25a2e0b9aa7ff341f4bbe2056fa669a40d74be97b0ca6b3343f52d4ab1fde1efbaaf1ff5
SSDEEP

1536:IwYbnea1qkteYqaDlFMm9Z+1akdg7Iblsu2h5tXzl:IwwekUYNFMMaPusP2hrj

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1632	4696	WerFault.exe	80
2280	4696	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 1632	4696	d565025fb421137adfc520c94d9d7fd666b9c76853f433fe796a5ff7c1162e5c.exe	84
PID 4696 wrote to memory of 1632	4696	d565025fb421137adfc520c94d9d7fd666b9c76853f433fe796a5ff7c1162e5c.exe	84
PID 4696 wrote to memory of 1632	4696	d565025fb421137adfc520c94d9d7fd666b9c76853f433fe796a5ff7c1162e5c.exe	84

C:\Users\Admin\AppData\Local\Temp\d565025fb421137adfc520c94d9d7fd666b9c76853f433fe796a5ff7c1162e5c.exe
"C:\Users\Admin\AppData\Local\Temp\d565025fb421137adfc520c94d9d7fd666b9c76853f433fe796a5ff7c1162e5c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 304
  2⤵
  - Program crash
  PID:1632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 304
  2⤵
  - Program crash
  PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4696 -ip 4696
1⤵
PID:2916