a269a586afe1e4cd05b056ecad2e7d151ca868085a09ffafc8c518febc1580a7

Analysis

max time kernel
165s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 23:03

Target

a269a586afe1e4cd05b056ecad2e7d151ca868085a09ffafc8c518febc1580a7.exe
Size

144KB
MD5

5366d0aad616bccca622db8f790aadac
SHA1

30422ed87f37b8da9de8a8c5e86ebd7c7c179144
SHA256

a269a586afe1e4cd05b056ecad2e7d151ca868085a09ffafc8c518febc1580a7
SHA512

0e3f038933f5b62e7c90879aa0d917c0ea460c246682b5a90a30962d09fd431649c50725a86fbabf685a158f6129830495b0c5b4f46e10b63d70a3d07c2f5ec2
SSDEEP

3072:aWx1BpilDHuxDm8gKsJo/3/MC4S7HVX20Qc3cYtr1Izq6:rFi9uAAsJo/334S7JrIzq6

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1104	2844	WerFault.exe	29
3432	2844	WerFault.exe	29

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 1104	2844	a269a586afe1e4cd05b056ecad2e7d151ca868085a09ffafc8c518febc1580a7.exe	88
PID 2844 wrote to memory of 1104	2844	a269a586afe1e4cd05b056ecad2e7d151ca868085a09ffafc8c518febc1580a7.exe	88
PID 2844 wrote to memory of 1104	2844	a269a586afe1e4cd05b056ecad2e7d151ca868085a09ffafc8c518febc1580a7.exe	88

C:\Users\Admin\AppData\Local\Temp\a269a586afe1e4cd05b056ecad2e7d151ca868085a09ffafc8c518febc1580a7.exe
"C:\Users\Admin\AppData\Local\Temp\a269a586afe1e4cd05b056ecad2e7d151ca868085a09ffafc8c518febc1580a7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 232
  2⤵
  - Program crash
  PID:1104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 232
  2⤵
  - Program crash
  PID:3432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 2844 -ip 2844
1⤵
PID:532