99e3ca7b885817939e5ff85e1aaab409274cfc82e5b62393693186accc80bbbf

Analysis

max time kernel
133s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 09:08

Target

99e3ca7b885817939e5ff85e1aaab409274cfc82e5b62393693186accc80bbbf.exe
Size

10.3MB
MD5

e8fe27e55b7647ef74fc372221e90210
SHA1

3e25417c5eca656e533d33ca87b03dd342524952
SHA256

99e3ca7b885817939e5ff85e1aaab409274cfc82e5b62393693186accc80bbbf
SHA512

2144739c73216fb977f33ff7b02dab711ce2202b5479c9618710ac6790b8466fb7e155ef618da88cdeb7cf8555827f0681356cfb8d09a815afd0c8d5a19cc02c
SSDEEP

196608:0qDUZpUsJ8JwjysJRRS1xLgoCXRlP3WgDkSN+8pX7FRytfs8adnxHSK:0qAZpzWYRS5q/Dbj7+tfs1xJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4828	4952	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 4828	4952	99e3ca7b885817939e5ff85e1aaab409274cfc82e5b62393693186accc80bbbf.exe	82
PID 4952 wrote to memory of 4828	4952	99e3ca7b885817939e5ff85e1aaab409274cfc82e5b62393693186accc80bbbf.exe	82
PID 4952 wrote to memory of 4828	4952	99e3ca7b885817939e5ff85e1aaab409274cfc82e5b62393693186accc80bbbf.exe	82

C:\Users\Admin\AppData\Local\Temp\99e3ca7b885817939e5ff85e1aaab409274cfc82e5b62393693186accc80bbbf.exe
"C:\Users\Admin\AppData\Local\Temp\99e3ca7b885817939e5ff85e1aaab409274cfc82e5b62393693186accc80bbbf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 380
  2⤵
  - Program crash
  PID:4828

memory/4952-132-0x0000000002870000-0x0000000002A32000-memory.dmp

Filesize
1.8MB

Download