b44a1b3db5f8ba8798c3bac3329291f134c9283c2b9e5a395684bf571817a76d

Analysis

max time kernel
188s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 08:06

Target

b44a1b3db5f8ba8798c3bac3329291f134c9283c2b9e5a395684bf571817a76d.exe
Size

690KB
MD5

6bffcf6419a946249524db92306f8d05
SHA1

325faffc254b2f6203bc892c1d2444231eb37a40
SHA256

b44a1b3db5f8ba8798c3bac3329291f134c9283c2b9e5a395684bf571817a76d
SHA512

4df8e4212f9ac8d1f31d2d88f694cda0ed776bbb6ca40e861b834c54b390b1a2561ab8ff78a649d4e869391161d430d7454bd207ff9b2f2f2254364cc3199131
SSDEEP

12288:eZhWyqsJ8IhNV3PQxlR+z/QmgiYLRZgQ/AGS6vtTxH0+1QEvtDc4:AhWyzjV3O2zoJEoAG3FW4t

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2792	2284	WerFault.exe	83
4476	2284	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2792	2284	b44a1b3db5f8ba8798c3bac3329291f134c9283c2b9e5a395684bf571817a76d.exe	86
PID 2284 wrote to memory of 2792	2284	b44a1b3db5f8ba8798c3bac3329291f134c9283c2b9e5a395684bf571817a76d.exe	86
PID 2284 wrote to memory of 2792	2284	b44a1b3db5f8ba8798c3bac3329291f134c9283c2b9e5a395684bf571817a76d.exe	86

C:\Users\Admin\AppData\Local\Temp\b44a1b3db5f8ba8798c3bac3329291f134c9283c2b9e5a395684bf571817a76d.exe
"C:\Users\Admin\AppData\Local\Temp\b44a1b3db5f8ba8798c3bac3329291f134c9283c2b9e5a395684bf571817a76d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 680
  2⤵
  - Program crash
  PID:2792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 680
  2⤵
  - Program crash
  PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2284 -ip 2284
1⤵
PID:3876

memory/2284-132-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2284-133-0x00000000022E0000-0x0000000002310000-memory.dmp

Filesize
192KB

Download
memory/2284-134-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2284-135-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2284-136-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2284-137-0x00000000022E0000-0x0000000002310000-memory.dmp

Filesize
192KB

Download
memory/2284-138-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2284-140-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download