afa6f00d4a21a115079ed53fb0b8dac644eaf25d7751fa08291f776077a15575

Analysis

max time kernel
190s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 02:56

Target

afa6f00d4a21a115079ed53fb0b8dac644eaf25d7751fa08291f776077a15575.exe
Size

71KB
MD5

34c42068ede8ca79064d07103668f6e0
SHA1

cf3228f07dd44c54343ac37b6ac0615950f1bec5
SHA256

afa6f00d4a21a115079ed53fb0b8dac644eaf25d7751fa08291f776077a15575
SHA512

f7e7d001ee0f3dfc97dee4b5e80acb6a87f01a488531d2471de714d95fd1b8030e94f980eb3d08eb427cf8509b0002b379e5d91cfb8fa6f11cc454faa76fcc43
SSDEEP

1536:t+b+F5tQkGaiYuN903i7fsEisKldjWGSY+A37feaCMJDmYsLIb4PvYqHB/AEN:t+q28XiIYfsR3WGSDADeak7dJHB/AW

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3168	3044	WerFault.exe	81
4944	3044	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 3168	3044	afa6f00d4a21a115079ed53fb0b8dac644eaf25d7751fa08291f776077a15575.exe	86
PID 3044 wrote to memory of 3168	3044	afa6f00d4a21a115079ed53fb0b8dac644eaf25d7751fa08291f776077a15575.exe	86
PID 3044 wrote to memory of 3168	3044	afa6f00d4a21a115079ed53fb0b8dac644eaf25d7751fa08291f776077a15575.exe	86

C:\Users\Admin\AppData\Local\Temp\afa6f00d4a21a115079ed53fb0b8dac644eaf25d7751fa08291f776077a15575.exe
"C:\Users\Admin\AppData\Local\Temp\afa6f00d4a21a115079ed53fb0b8dac644eaf25d7751fa08291f776077a15575.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 236
  2⤵
  - Program crash
  PID:3168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 236
  2⤵
  - Program crash
  PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3044 -ip 3044
1⤵
PID:1124

memory/3044-132-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3044-133-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download