ce8e9e3e24f8f55383a97d4742052e460b4c74b32105d9fbbf02cfade791089a

Analysis

max time kernel
150s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 13:18

Target

ce8e9e3e24f8f55383a97d4742052e460b4c74b32105d9fbbf02cfade791089a.exe
Size

40KB
MD5

ac8ef78605594d2bf74fe0d8f508e96f
SHA1

601905e60d963a819f8e1144c1b3135edc6023f5
SHA256

ce8e9e3e24f8f55383a97d4742052e460b4c74b32105d9fbbf02cfade791089a
SHA512

68491b3ea2abb5e2466ae5a9a86ec457f59c88177ed310d9afe9273f907e17cc11544b339a1b9c532e4829c145f83ca5868667346d9aadc5d368f6a55a76f79f
SSDEEP

768:fW/NOcgT15LqLFsCSD4WYS48E/apqyVvSqPnC000qs:elcLLLMLW/pqycqP3X

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2072	4748	WerFault.exe	81
1580	4748	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 1580	4748	ce8e9e3e24f8f55383a97d4742052e460b4c74b32105d9fbbf02cfade791089a.exe	86
PID 4748 wrote to memory of 1580	4748	ce8e9e3e24f8f55383a97d4742052e460b4c74b32105d9fbbf02cfade791089a.exe	86
PID 4748 wrote to memory of 1580	4748	ce8e9e3e24f8f55383a97d4742052e460b4c74b32105d9fbbf02cfade791089a.exe	86

C:\Users\Admin\AppData\Local\Temp\ce8e9e3e24f8f55383a97d4742052e460b4c74b32105d9fbbf02cfade791089a.exe
"C:\Users\Admin\AppData\Local\Temp\ce8e9e3e24f8f55383a97d4742052e460b4c74b32105d9fbbf02cfade791089a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 196
  2⤵
  - Program crash
  PID:2072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 196
  2⤵
  - Program crash
  PID:1580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4748 -ip 4748
1⤵
PID:1668