9f2cd71263e7bcbbf6486490d3f36d07211190b3a32ced86d321455c741826b7

Analysis

max time kernel
129s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 16:32

Target

9f2cd71263e7bcbbf6486490d3f36d07211190b3a32ced86d321455c741826b7.exe
Size

44KB
MD5

89152f3080d07158b940e95c8249c2d0
SHA1

3eb5b500ba979631639da9c07998cd03dd1ef5d3
SHA256

9f2cd71263e7bcbbf6486490d3f36d07211190b3a32ced86d321455c741826b7
SHA512

005535156217852dac41a4567fbb244859eea0d00f60308bc7e7239fd3f9907494b7de58e20217f6c6e1ab7cca5b0630d7f2a7793c21d747d123b37ca11283ca
SSDEEP

384:b9pjxtBFdB1sU8zdd7H2o3UEUD4g94xCX8lsdFjJo7AzJdk:bDlFdB1sUPf94AXBdFOOJ2

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
788	4648	WerFault.exe	77
3752	4648	WerFault.exe	77

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 788	4648	9f2cd71263e7bcbbf6486490d3f36d07211190b3a32ced86d321455c741826b7.exe	80
PID 4648 wrote to memory of 788	4648	9f2cd71263e7bcbbf6486490d3f36d07211190b3a32ced86d321455c741826b7.exe	80
PID 4648 wrote to memory of 788	4648	9f2cd71263e7bcbbf6486490d3f36d07211190b3a32ced86d321455c741826b7.exe	80

C:\Users\Admin\AppData\Local\Temp\9f2cd71263e7bcbbf6486490d3f36d07211190b3a32ced86d321455c741826b7.exe
"C:\Users\Admin\AppData\Local\Temp\9f2cd71263e7bcbbf6486490d3f36d07211190b3a32ced86d321455c741826b7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 196
  2⤵
  - Program crash
  PID:788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 196
  2⤵
  - Program crash
  PID:3752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4648 -ip 4648
1⤵
PID:4768