a2c00ae3fba6802e721e99ccc1cf883ecb896058ce3c806a416326ec3d2e05b5

Analysis

max time kernel
178s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 06:44

Target

a2c00ae3fba6802e721e99ccc1cf883ecb896058ce3c806a416326ec3d2e05b5.exe
Size

108KB
MD5

b8ffee5e65225f033d71265694184165
SHA1

c23af4c8b6bd583b87667e1165499c2f65cad18d
SHA256

a2c00ae3fba6802e721e99ccc1cf883ecb896058ce3c806a416326ec3d2e05b5
SHA512

dc97dc5b7c937bd1d335f61503bddbd1679e79c6d486c6c0149efbf813f7ead6be9159d7ecf984dfd410620ba5be97c92bfd8edaa301f67312c78e4586673923
SSDEEP

1536:uJe9cLBbksSc5tlnV4nZxVq2doEdE6glBBsE/C1gn3WEYfO3h/JbV9SDhlRpswRl:CpLBosB7nUZxAR6gdTXRvf9SDPswag

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4336	3020	WerFault.exe	81
2284	3020	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 4336	3020	a2c00ae3fba6802e721e99ccc1cf883ecb896058ce3c806a416326ec3d2e05b5.exe	84
PID 3020 wrote to memory of 4336	3020	a2c00ae3fba6802e721e99ccc1cf883ecb896058ce3c806a416326ec3d2e05b5.exe	84
PID 3020 wrote to memory of 4336	3020	a2c00ae3fba6802e721e99ccc1cf883ecb896058ce3c806a416326ec3d2e05b5.exe	84

C:\Users\Admin\AppData\Local\Temp\a2c00ae3fba6802e721e99ccc1cf883ecb896058ce3c806a416326ec3d2e05b5.exe
"C:\Users\Admin\AppData\Local\Temp\a2c00ae3fba6802e721e99ccc1cf883ecb896058ce3c806a416326ec3d2e05b5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 388
  2⤵
  - Program crash
  PID:4336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 388
  2⤵
  - Program crash
  PID:2284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3020 -ip 3020
1⤵
PID:5004