b336524fdcd352829949e29a8ba4149ba7ed32dcd967fde039f0704fdb1722c9

Analysis

max time kernel
325s
max time network
359s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 07:11

Target

b336524fdcd352829949e29a8ba4149ba7ed32dcd967fde039f0704fdb1722c9.exe
Size

128KB
MD5

b59b9779e34b6ab7c3b92e3666823a2b
SHA1

75e7452339458562f01d7290c2af2ee32de9cb2b
SHA256

b336524fdcd352829949e29a8ba4149ba7ed32dcd967fde039f0704fdb1722c9
SHA512

a2cb5103b403c8071f9ece3c20a891022a47aa9b0f178c87f3a5d37b7fb475d03f6a6189f366b91c0fa0f9d7410a741e6c68eacd1a586fd17ba3d2d9eff35fb3
SSDEEP

3072:fewvFTjuyu6dj2J67lgOSz+9xNYuQbB/F0zW7qnYEwg91l80L80FY3FguRXl:Lvxa8dS6eOSz+HNYX90zWcH91jLKFguf

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
8	3160	WerFault.exe	80
540	3160	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 8	3160	b336524fdcd352829949e29a8ba4149ba7ed32dcd967fde039f0704fdb1722c9.exe	83
PID 3160 wrote to memory of 8	3160	b336524fdcd352829949e29a8ba4149ba7ed32dcd967fde039f0704fdb1722c9.exe	83
PID 3160 wrote to memory of 8	3160	b336524fdcd352829949e29a8ba4149ba7ed32dcd967fde039f0704fdb1722c9.exe	83

C:\Users\Admin\AppData\Local\Temp\b336524fdcd352829949e29a8ba4149ba7ed32dcd967fde039f0704fdb1722c9.exe
"C:\Users\Admin\AppData\Local\Temp\b336524fdcd352829949e29a8ba4149ba7ed32dcd967fde039f0704fdb1722c9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 488
  2⤵
  - Program crash
  PID:8
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 488
  2⤵
  - Program crash
  PID:540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 3160 -ip 3160
1⤵
PID:3068