9735527911fe79127bb4cac6cab68bb6e3da29592921e1cfbfcd496245aeb74f

Analysis

max time kernel
177s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 01:57

Target
043e2bd5561448bc4871a1737a42ca8d.exe
Size 1.8MB
Sample221202-cdarbsfg4y
SHA256 9735527911fe79127bb4cac6cab68bb6e3da29592921e1cfbfcd496245aeb74f
MD5 043e2bd5561448bc4871a1737a42ca8d
SHA1 8ab05824ccaffed63a038b6776bcad48eaf4016a
SHA512 6b3f780d72c95eae51db96740e567152110956871dbb939fac7b1a90bde5540f30c7168deff3963458af20e89fb44cf823d31b064e211351e6c61b969245b04e
SSDEEP 49152:FLwabCbUuO0f0XuwycOJPyGn+qNHHzQW6:dtbChOvXuwFO5yG+qe
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2124	1996	WerFault.exe	81
1180	1996	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2124	1996	043e2bd5561448bc4871a1737a42ca8d.exe	84
PID 1996 wrote to memory of 2124	1996	043e2bd5561448bc4871a1737a42ca8d.exe	84
PID 1996 wrote to memory of 2124	1996	043e2bd5561448bc4871a1737a42ca8d.exe	84

C:\Users\Admin\AppData\Local\Temp\043e2bd5561448bc4871a1737a42ca8d.exe
"C:\Users\Admin\AppData\Local\Temp\043e2bd5561448bc4871a1737a42ca8d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 380
  2⤵
  - Program crash
  PID:2124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 380
  2⤵
  - Program crash
  PID:1180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1996 -ip 1996
1⤵
PID:1524