914743c9adf3d20d9c526d183ef7fc807f05065f0e3f937fcbe416c28eef71af

Analysis

max time kernel
179s
max time network
213s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 21:10

Target

914743c9adf3d20d9c526d183ef7fc807f05065f0e3f937fcbe416c28eef71af.exe
Size

75KB
MD5

f80374076e02cf485810f6dc9d58151a
SHA1

71ad6e77c3f54159bd34351cd1aba95dca17b6df
SHA256

914743c9adf3d20d9c526d183ef7fc807f05065f0e3f937fcbe416c28eef71af
SHA512

09309f2620f2bc4d9a8a51d88f00986f3fcafe204a452f3e3caf86104c77f5b9b8ce4fd16f857f2821b19d811ab9ba9bdbf398c55d38dab067e8e7823144cbe7
SSDEEP

768:o5tj6WixRjuwRDCaI3lhjtDw/XZd9Kbjobh7v8X1w1mqspegyV0DIEq+:o5tjKMwtCVwvNKH2hr84spPsq

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4480	1560	WerFault.exe	80
2680	1560	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 4480	1560	914743c9adf3d20d9c526d183ef7fc807f05065f0e3f937fcbe416c28eef71af.exe	83
PID 1560 wrote to memory of 4480	1560	914743c9adf3d20d9c526d183ef7fc807f05065f0e3f937fcbe416c28eef71af.exe	83
PID 1560 wrote to memory of 4480	1560	914743c9adf3d20d9c526d183ef7fc807f05065f0e3f937fcbe416c28eef71af.exe	83

C:\Users\Admin\AppData\Local\Temp\914743c9adf3d20d9c526d183ef7fc807f05065f0e3f937fcbe416c28eef71af.exe
"C:\Users\Admin\AppData\Local\Temp\914743c9adf3d20d9c526d183ef7fc807f05065f0e3f937fcbe416c28eef71af.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 464
  2⤵
  - Program crash
  PID:4480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 464
  2⤵
  - Program crash
  PID:2680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1560 -ip 1560
1⤵
PID:1044

memory/1560-132-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1560-133-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download