a0293dd4166fc71395390dd623d773255db71b6696af4e27ac7b602a7c34ba04

Analysis

max time kernel
184s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 10:42

Target

a0293dd4166fc71395390dd623d773255db71b6696af4e27ac7b602a7c34ba04.exe
Size

386KB
MD5

7d769178eaa5d2b060ab434a9783ee46
SHA1

6f1c4d00bbc516a0c45b2d168dc32c3ccc5dc127
SHA256

a0293dd4166fc71395390dd623d773255db71b6696af4e27ac7b602a7c34ba04
SHA512

779a87dcfe8e2abacec5a0f430ae068dd45938f3858dd94350f1ff9820361c0650f8a5397223fe0be661a3bc2cf7adf573daed9af83e47e41ae111ee3391bf73
SSDEEP

12288:zCfcbfAnOLX5fK/EuSp4I+XRYPj6qSrFlEfSI6ED:zL96E2FRYj6qnfD

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2412	3792	WerFault.exe	76
704	3792	WerFault.exe	76

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 2412	3792	a0293dd4166fc71395390dd623d773255db71b6696af4e27ac7b602a7c34ba04.exe	79
PID 3792 wrote to memory of 2412	3792	a0293dd4166fc71395390dd623d773255db71b6696af4e27ac7b602a7c34ba04.exe	79
PID 3792 wrote to memory of 2412	3792	a0293dd4166fc71395390dd623d773255db71b6696af4e27ac7b602a7c34ba04.exe	79

C:\Users\Admin\AppData\Local\Temp\a0293dd4166fc71395390dd623d773255db71b6696af4e27ac7b602a7c34ba04.exe
"C:\Users\Admin\AppData\Local\Temp\a0293dd4166fc71395390dd623d773255db71b6696af4e27ac7b602a7c34ba04.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 288
  2⤵
  - Program crash
  PID:2412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 288
  2⤵
  - Program crash
  PID:704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3792 -ip 3792
1⤵
PID:4860