c1b9c4df8a4417c20c4b9be8f3d88d07a9fc75f28630c8119efb3a6ed5c2b6bb

Analysis

max time kernel
198s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 21:52

Target

c1b9c4df8a4417c20c4b9be8f3d88d07a9fc75f28630c8119efb3a6ed5c2b6bb.exe
Size

721KB
MD5

c7f5980e67bd54cb2cb6903f1906e119
SHA1

e66568fb17368dd5cd82958d2d5858249ecf5b9a
SHA256

c1b9c4df8a4417c20c4b9be8f3d88d07a9fc75f28630c8119efb3a6ed5c2b6bb
SHA512

eaecde0461c2194635695c08d0cf158195763a8cb554d0923ae81f731737fdb2a60201d25450f35cadaddcdc7f3981ea5935d375eb4442bc729459427f1ffd61
SSDEEP

12288:Cc//////ex2hhiyL0WYlTJPqFLTb6oIxSs6tZPnMZ8/ilgLZapFgDg9tKK2xugSt:Cc//////O4L0WY5RSLTWoIx5+ZfYVK70

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
220	1524	WerFault.exe	c1b9c4df8a4417c20c4b9be8f3d88d07a9fc75f28630c8119efb3a6ed5c2b6bb.exe
1652	1524	WerFault.exe	c1b9c4df8a4417c20c4b9be8f3d88d07a9fc75f28630c8119efb3a6ed5c2b6bb.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c1b9c4df8a4417c20c4b9be8f3d88d07a9fc75f28630c8119efb3a6ed5c2b6bb.exe

description	pid	process	target process
PID 1524 wrote to memory of 220	1524	c1b9c4df8a4417c20c4b9be8f3d88d07a9fc75f28630c8119efb3a6ed5c2b6bb.exe	WerFault.exe
PID 1524 wrote to memory of 220	1524	c1b9c4df8a4417c20c4b9be8f3d88d07a9fc75f28630c8119efb3a6ed5c2b6bb.exe	WerFault.exe
PID 1524 wrote to memory of 220	1524	c1b9c4df8a4417c20c4b9be8f3d88d07a9fc75f28630c8119efb3a6ed5c2b6bb.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c1b9c4df8a4417c20c4b9be8f3d88d07a9fc75f28630c8119efb3a6ed5c2b6bb.exe
"C:\Users\Admin\AppData\Local\Temp\c1b9c4df8a4417c20c4b9be8f3d88d07a9fc75f28630c8119efb3a6ed5c2b6bb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 380
2⤵
- Program crash
PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 380
2⤵
- Program crash
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 1524 -ip 1524
1⤵
PID:3140