f64f5fbdbd476521304478c888b1fe214f64477b72f36c98b270c9ae619b81db

Analysis

max time kernel
237s
max time network
296s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 05:48

Target

f64f5fbdbd476521304478c888b1fe214f64477b72f36c98b270c9ae619b81db.exe
Size

32KB
MD5

808ff49a406fc79baab745a1408028cb
SHA1

9adf4121cd00f810336a62ca4385d38d92749419
SHA256

f64f5fbdbd476521304478c888b1fe214f64477b72f36c98b270c9ae619b81db
SHA512

51bddd45ae0d10353f482835a651382bee15c8ff63f5363843ac57a40ea703a22adab0d49da21a5c47b47286ab3d82f61b813e81934c5f0ee16b4f27b7a39308
SSDEEP

384:OE3HA/ikuDtzwgwIA5X1D9S3cHH2hS4wkkI:OE3HA/7n8+1s0WcbkL

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1596	5048	WerFault.exe	79
32	5048	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 1596	5048	f64f5fbdbd476521304478c888b1fe214f64477b72f36c98b270c9ae619b81db.exe	84
PID 5048 wrote to memory of 1596	5048	f64f5fbdbd476521304478c888b1fe214f64477b72f36c98b270c9ae619b81db.exe	84
PID 5048 wrote to memory of 1596	5048	f64f5fbdbd476521304478c888b1fe214f64477b72f36c98b270c9ae619b81db.exe	84

C:\Users\Admin\AppData\Local\Temp\f64f5fbdbd476521304478c888b1fe214f64477b72f36c98b270c9ae619b81db.exe
"C:\Users\Admin\AppData\Local\Temp\f64f5fbdbd476521304478c888b1fe214f64477b72f36c98b270c9ae619b81db.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 408
  2⤵
  - Program crash
  PID:1596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 408
  2⤵
  - Program crash
  PID:32

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5048 -ip 5048
1⤵
PID:4596