b043b55b693cc0758261e6c306b6028a155fc080797dfb2b6091d75d1cd22203

Analysis

max time kernel
154s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 08:59

Target

b043b55b693cc0758261e6c306b6028a155fc080797dfb2b6091d75d1cd22203.exe
Size

173KB
MD5

3c2e2156fbb38ff48ebad58ba07f4644
SHA1

fce3cc91d9554ecce9ca74b93fd7af2bd4acdf4c
SHA256

b043b55b693cc0758261e6c306b6028a155fc080797dfb2b6091d75d1cd22203
SHA512

be9530e5f32d4314293d4c5a4ffd0b301d078cc8fc38f44fbe4ed506b6d209b4e4bac4ac55e8858464985d77628a598f347d447576c7f3d06aba3d7ab60f5d61
SSDEEP

3072:bhkPbdz5RI+FlB6MfXhaYf+YC/A114IV71h7rNIVCTXA3eZIkesJPPqb5g+VTjKX:NabBI+/Asrtg2erxK

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
964	504	WerFault.exe	83
1780	504	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 504 wrote to memory of 964	504	b043b55b693cc0758261e6c306b6028a155fc080797dfb2b6091d75d1cd22203.exe	86
PID 504 wrote to memory of 964	504	b043b55b693cc0758261e6c306b6028a155fc080797dfb2b6091d75d1cd22203.exe	86
PID 504 wrote to memory of 964	504	b043b55b693cc0758261e6c306b6028a155fc080797dfb2b6091d75d1cd22203.exe	86

C:\Users\Admin\AppData\Local\Temp\b043b55b693cc0758261e6c306b6028a155fc080797dfb2b6091d75d1cd22203.exe
"C:\Users\Admin\AppData\Local\Temp\b043b55b693cc0758261e6c306b6028a155fc080797dfb2b6091d75d1cd22203.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 504 -s 248
  2⤵
  - Program crash
  PID:964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 504 -s 248
  2⤵
  - Program crash
  PID:1780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 504 -ip 504
1⤵
PID:1784

memory/504-132-0x0000000000080000-0x00000000000AD000-memory.dmp

Filesize
180KB

Download