f5814b0cbc19edad36606c523d8163a82bc87ea36e04d8c8057776ba1c42a655

Analysis

max time kernel
316s
max time network
343s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 17:51

Target

f5814b0cbc19edad36606c523d8163a82bc87ea36e04d8c8057776ba1c42a655.exe
Size

393KB
MD5

6571af1e5bd030054762d84a12ca6812
SHA1

e4cae2433d886ad8a1f69a42f93f5a68b4f2ee8c
SHA256

f5814b0cbc19edad36606c523d8163a82bc87ea36e04d8c8057776ba1c42a655
SHA512

f8b02dc680ecf1a3cf40d083145b97ae1abb288bd1a42eab7c59d265471dc108b3b16fceb321fc1192af15ebccf82bda42228504a7a5e5d22fb469b7409f8d57
SSDEEP

6144:1bYNeo5nhxlGFWPgynsiNYBoGFFYhaRRXcuCiX++Vzrmkqmu5jbmdVnZ9qxG:1oeQnhxUUSbuGFehOsuC8XmklbLqxG

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4768 3468 WerFault.exe f5814b0cbc19edad36606c523d8163a82bc87ea36e04d8c8057776ba1c42a655.exe

pid	pid_target	process	target process
4768	3468	WerFault.exe	f5814b0cbc19edad36606c523d8163a82bc87ea36e04d8c8057776ba1c42a655.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

f5814b0cbc19edad36606c523d8163a82bc87ea36e04d8c8057776ba1c42a655.exe

description	pid	process	target process
PID 3468 wrote to memory of 4768	3468	f5814b0cbc19edad36606c523d8163a82bc87ea36e04d8c8057776ba1c42a655.exe	WerFault.exe
PID 3468 wrote to memory of 4768	3468	f5814b0cbc19edad36606c523d8163a82bc87ea36e04d8c8057776ba1c42a655.exe	WerFault.exe
PID 3468 wrote to memory of 4768	3468	f5814b0cbc19edad36606c523d8163a82bc87ea36e04d8c8057776ba1c42a655.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\f5814b0cbc19edad36606c523d8163a82bc87ea36e04d8c8057776ba1c42a655.exe
"C:\Users\Admin\AppData\Local\Temp\f5814b0cbc19edad36606c523d8163a82bc87ea36e04d8c8057776ba1c42a655.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 380
2⤵
- Program crash
PID:4768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3468 -ip 3468
1⤵
PID:1336