b0e5cb12fe477ab630d3b29d6b5cc4aee0f4769212dea280455f2785c3cc5314

Analysis

max time kernel
316s
max time network
415s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 15:11

Target

b0e5cb12fe477ab630d3b29d6b5cc4aee0f4769212dea280455f2785c3cc5314.exe
Size

850KB
MD5

82c87adc007f4f3c0ca29af26d66df46
SHA1

6df11211a78617570e11242ebd1dbe572de042ea
SHA256

b0e5cb12fe477ab630d3b29d6b5cc4aee0f4769212dea280455f2785c3cc5314
SHA512

3fb3392e793211fee1a5af44b655ecc8d07b2a511ea0a21be516716b67e9dd6106ced1806c62bf8aba82c984cb205dec88c99ac35c04ecc01c933b163b39c5d5
SSDEEP

24576:6AtU6bMGq6WxNMj2FLDHeZbKQiJWhu1O6Qej5Mvk8qCLAfJo:IfEK5NDeZVikhuABet5CLA2

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
620	4464	WerFault.exe	76
1316	4464	WerFault.exe	76

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 620	4464	b0e5cb12fe477ab630d3b29d6b5cc4aee0f4769212dea280455f2785c3cc5314.exe	83
PID 4464 wrote to memory of 620	4464	b0e5cb12fe477ab630d3b29d6b5cc4aee0f4769212dea280455f2785c3cc5314.exe	83
PID 4464 wrote to memory of 620	4464	b0e5cb12fe477ab630d3b29d6b5cc4aee0f4769212dea280455f2785c3cc5314.exe	83

C:\Users\Admin\AppData\Local\Temp\b0e5cb12fe477ab630d3b29d6b5cc4aee0f4769212dea280455f2785c3cc5314.exe
"C:\Users\Admin\AppData\Local\Temp\b0e5cb12fe477ab630d3b29d6b5cc4aee0f4769212dea280455f2785c3cc5314.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 472
  2⤵
  - Program crash
  PID:620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 472
  2⤵
  - Program crash
  PID:1316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4464 -ip 4464
1⤵
PID:4292