98bc4051a30f4ed698c66727e87eef9a133e96287700e88acf0898779d79c510

Analysis

max time kernel
189s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 14:48

Target

98bc4051a30f4ed698c66727e87eef9a133e96287700e88acf0898779d79c510.exe
Size

527KB
MD5

365063010247a269989b5cb7c0caf8bb
SHA1

62621aa97c2f7e6b6a513f3587267bd3bc1f9a1e
SHA256

98bc4051a30f4ed698c66727e87eef9a133e96287700e88acf0898779d79c510
SHA512

04572456e95fde7f00437c12d4f9b7da3616e856584c69cdc18a3b1e3381cea994e2f8643b6c0c67e129d08ea4a162b5b68831aae1f3be3269eba900f8406ca0
SSDEEP

12288:MGf4LJX4zRiiGFxmfNJ6El+nsjOQGRLNtTirdLy7d7qWe8:MpX4zR3gxMi2+sfGR7TEdLyxuW1

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
428	1692	WerFault.exe	83
856	1692	WerFault.exe	83

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 208	1692	98bc4051a30f4ed698c66727e87eef9a133e96287700e88acf0898779d79c510.exe	84
PID 1692 wrote to memory of 208	1692	98bc4051a30f4ed698c66727e87eef9a133e96287700e88acf0898779d79c510.exe	84
PID 1692 wrote to memory of 428	1692	98bc4051a30f4ed698c66727e87eef9a133e96287700e88acf0898779d79c510.exe	86
PID 1692 wrote to memory of 428	1692	98bc4051a30f4ed698c66727e87eef9a133e96287700e88acf0898779d79c510.exe	86
PID 1692 wrote to memory of 428	1692	98bc4051a30f4ed698c66727e87eef9a133e96287700e88acf0898779d79c510.exe	86

C:\Users\Admin\AppData\Local\Temp\98bc4051a30f4ed698c66727e87eef9a133e96287700e88acf0898779d79c510.exe
"C:\Users\Admin\AppData\Local\Temp\98bc4051a30f4ed698c66727e87eef9a133e96287700e88acf0898779d79c510.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" ¨Á
  2⤵
  PID:208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 620
  2⤵
  - Program crash
  PID:428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 620
  2⤵
  - Program crash
  PID:856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1692 -ip 1692
1⤵
PID:216

memory/1692-132-0x0000000000400000-0x00000000004EE000-memory.dmp

Filesize
952KB

Download
memory/1692-133-0x0000000002180000-0x00000000021C3000-memory.dmp

Filesize
268KB

Download
memory/1692-134-0x00000000023A0000-0x00000000023A8000-memory.dmp

Filesize
32KB

Download
memory/1692-135-0x0000000000400000-0x00000000004EE000-memory.dmp

Filesize
952KB

Download
memory/1692-136-0x0000000002180000-0x00000000021C3000-memory.dmp

Filesize
268KB

Download
memory/1692-138-0x0000000000400000-0x00000000004EE000-memory.dmp

Filesize
952KB

Download