d1241e41d615b0f5e0abc3572f7022825e00a73f0b4efef07426699d167fb979

Analysis

max time kernel
152s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 17:13

Target

d1241e41d615b0f5e0abc3572f7022825e00a73f0b4efef07426699d167fb979.exe
Size

111KB
MD5

a9d5a942d88fb1d3f3013c26ef3d93b3
SHA1

ad72a3c8185cd4c9ffa8fc44eb4fee99c2ed89e4
SHA256

d1241e41d615b0f5e0abc3572f7022825e00a73f0b4efef07426699d167fb979
SHA512

2b16f5a82a2a5cb6db1bdf9b2244a9767e03f24c8d32c83c8c3d6a6a01e91ed49110525b1ce07e1939bac0f09b41cfd743282ea2cb1628e23fa4044a9a4045c2
SSDEEP

1536:wXTnwydpuhq2e2qmZejP73elsMXOXOyBomEDIg/VStQOsoZ9hnk8kbqhPD3G:wznTcNejPDos/2nVSmO59K8cqV2

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
100	5092	WerFault.exe	80
2748	5092	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 100	5092	d1241e41d615b0f5e0abc3572f7022825e00a73f0b4efef07426699d167fb979.exe	84
PID 5092 wrote to memory of 100	5092	d1241e41d615b0f5e0abc3572f7022825e00a73f0b4efef07426699d167fb979.exe	84
PID 5092 wrote to memory of 100	5092	d1241e41d615b0f5e0abc3572f7022825e00a73f0b4efef07426699d167fb979.exe	84

C:\Users\Admin\AppData\Local\Temp\d1241e41d615b0f5e0abc3572f7022825e00a73f0b4efef07426699d167fb979.exe
"C:\Users\Admin\AppData\Local\Temp\d1241e41d615b0f5e0abc3572f7022825e00a73f0b4efef07426699d167fb979.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 228
  2⤵
  - Program crash
  PID:100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 228
  2⤵
  - Program crash
  PID:2748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5092 -ip 5092
1⤵
PID:1536

memory/5092-132-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download