ba72caf65926d8009e9604e1710cd1e2216f8e7926116a865284954570114800

Analysis

max time kernel
299s
max time network
353s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 07:43

Target

ba72caf65926d8009e9604e1710cd1e2216f8e7926116a865284954570114800.exe
Size

46KB
MD5

b6656bdb28f9dc378887bd983b8d9c81
SHA1

c9251bb5a5d01cd38de9ca4ef590d8f5b2aaaa16
SHA256

ba72caf65926d8009e9604e1710cd1e2216f8e7926116a865284954570114800
SHA512

4e8a1eba9928d0c6c5590a8b3e61332cbda6fb6dc821e3808ab8c23630f63cabf84e1f450e4a161bd9eeed7dc0cff9e353262db4d2dce9e4db7b7d1eb78c0455
SSDEEP

768:a+TuEnMX3HuQ8p/BjEqEXceq+pDWHlQfxbmN:aBRX3DkB1Wceq+EAtmN

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3824	4984	WerFault.exe	78
3880	4984	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 3824	4984	ba72caf65926d8009e9604e1710cd1e2216f8e7926116a865284954570114800.exe	81
PID 4984 wrote to memory of 3824	4984	ba72caf65926d8009e9604e1710cd1e2216f8e7926116a865284954570114800.exe	81
PID 4984 wrote to memory of 3824	4984	ba72caf65926d8009e9604e1710cd1e2216f8e7926116a865284954570114800.exe	81

C:\Users\Admin\AppData\Local\Temp\ba72caf65926d8009e9604e1710cd1e2216f8e7926116a865284954570114800.exe
"C:\Users\Admin\AppData\Local\Temp\ba72caf65926d8009e9604e1710cd1e2216f8e7926116a865284954570114800.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 252
  2⤵
  - Program crash
  PID:3824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 252
  2⤵
  - Program crash
  PID:3880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4984 -ip 4984
1⤵
PID:3916