a7b5f84ee72266be6d0dc98b758fb0930f84a51bdb2a575b8b3c9049bd1a3ae6

Analysis

max time kernel
136s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 19:57

Target

a7b5f84ee72266be6d0dc98b758fb0930f84a51bdb2a575b8b3c9049bd1a3ae6.exe
Size

65KB
MD5

64256d7aa5880bbd629df194e1d96b0f
SHA1

e55e2fd1f8cbe4cd74ac1f27dd830f614b463c3e
SHA256

a7b5f84ee72266be6d0dc98b758fb0930f84a51bdb2a575b8b3c9049bd1a3ae6
SHA512

844404b0ced740eeea2d29655d96acd3f8bfbb6e4c740373be3d88920adcd10768909031c6ed2eb4945d49fc6103f18d915d684a09be36c52a92a17922c27d84
SSDEEP

1536:U+dvQFZ7Fxqlq+MLMRqyBpB+j5eBYGp4mh:U+dv2ZFxqMFyBpglYvim

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4200	860	WerFault.exe	82
372	860	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 4200	860	a7b5f84ee72266be6d0dc98b758fb0930f84a51bdb2a575b8b3c9049bd1a3ae6.exe	84
PID 860 wrote to memory of 4200	860	a7b5f84ee72266be6d0dc98b758fb0930f84a51bdb2a575b8b3c9049bd1a3ae6.exe	84
PID 860 wrote to memory of 4200	860	a7b5f84ee72266be6d0dc98b758fb0930f84a51bdb2a575b8b3c9049bd1a3ae6.exe	84

C:\Users\Admin\AppData\Local\Temp\a7b5f84ee72266be6d0dc98b758fb0930f84a51bdb2a575b8b3c9049bd1a3ae6.exe
"C:\Users\Admin\AppData\Local\Temp\a7b5f84ee72266be6d0dc98b758fb0930f84a51bdb2a575b8b3c9049bd1a3ae6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 340
  2⤵
  - Program crash
  PID:4200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 340
  2⤵
  - Program crash
  PID:372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 860 -ip 860
1⤵
PID:1632

memory/860-132-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download