c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 01:15

Target

c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
Size

88KB
MD5

440e9b7f5ba2fc16a0c0b368abd74130
SHA1

370f814cf9e73d4396ab089b95e5135669482af1
SHA256

c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407
SHA512

63c599119c30fec5ad843faf9f71dad8be46623f851cfaac92b182e88a73a9c089ab2678b431323c5640f568816f69bc1283eae3fbdbd48f405320d5db8335b5
SSDEEP

1536:jMQKzwcnBIK+k7u7rSWiktMUtrHqSKzA+CNzGcCNs:IDzwcnj7u7rSWikKUtzq1QhGcC

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3544	1048	WerFault.exe	76
3872	1048	WerFault.exe	76

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 3544	1048	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	79
PID 1048 wrote to memory of 3544	1048	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	79
PID 1048 wrote to memory of 3544	1048	c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe	79

C:\Users\Admin\AppData\Local\Temp\c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe
"C:\Users\Admin\AppData\Local\Temp\c6397f5f4d837be0009037704174c32c5d6e821a272fffaecd2f28a3dad60407.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 476
  2⤵
  - Program crash
  PID:3544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 476
  2⤵
  - Program crash
  PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1048 -ip 1048
1⤵
PID:544

memory/1048-132-0x0000000001000000-0x000000000101E000-memory.dmp

Filesize
120KB

Download