866bd7bbb4cfc26328af5c4f825e4561e61e437fda2aa5c52aba76c68b2f1e40

Analysis

max time kernel
285s
max time network
355s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 17:28

Target

866bd7bbb4cfc26328af5c4f825e4561e61e437fda2aa5c52aba76c68b2f1e40.exe
Size

523KB
MD5

c87734d30fd6554e64ad009ac4c9e837
SHA1

7f88570eb3ecceb78ec55cb637dfbb8ced9d874e
SHA256

866bd7bbb4cfc26328af5c4f825e4561e61e437fda2aa5c52aba76c68b2f1e40
SHA512

b7ff2ce2f7438fb72c73bc4a05f59d0bf279e6b18d176d9ea78f7a2a1cced309dc079e954376a7add6b089d1cef970f067e7de05e689ad7813f5cc1930b7798e
SSDEEP

6144:HTV0YSXdpw2qLXv1Wl2d3Et9QEVdi4dZScb1oAMSaAH3h:zKXPw3XJ3Etbxbied

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1868	952	WerFault.exe	79
3804	952	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 1868	952	866bd7bbb4cfc26328af5c4f825e4561e61e437fda2aa5c52aba76c68b2f1e40.exe	82
PID 952 wrote to memory of 1868	952	866bd7bbb4cfc26328af5c4f825e4561e61e437fda2aa5c52aba76c68b2f1e40.exe	82
PID 952 wrote to memory of 1868	952	866bd7bbb4cfc26328af5c4f825e4561e61e437fda2aa5c52aba76c68b2f1e40.exe	82

C:\Users\Admin\AppData\Local\Temp\866bd7bbb4cfc26328af5c4f825e4561e61e437fda2aa5c52aba76c68b2f1e40.exe
"C:\Users\Admin\AppData\Local\Temp\866bd7bbb4cfc26328af5c4f825e4561e61e437fda2aa5c52aba76c68b2f1e40.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 224
  2⤵
  - Program crash
  PID:1868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 224
  2⤵
  - Program crash
  PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 952 -ip 952
1⤵
PID:3908

memory/952-132-0x0000000000400000-0x00000000005AA000-memory.dmp

Filesize
1.7MB

Download
memory/952-133-0x0000000000400000-0x00000000005AA000-memory.dmp

Filesize
1.7MB

Download