c60bdf67b52de4cb286881e25382254656959d65149793819b064406623e6bfc

Analysis

max time kernel
153s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 16:41

Target

c60bdf67b52de4cb286881e25382254656959d65149793819b064406623e6bfc.exe
Size

497KB
MD5

98ebf2052c57dc943ca614b5fd083a6c
SHA1

4b12060ba89cd059300dc4b86a6022db3c84b4ed
SHA256

c60bdf67b52de4cb286881e25382254656959d65149793819b064406623e6bfc
SHA512

f875d4d0065caabb0cb89f3d1918953c0ee368a95567e17a7bdebca533e7823467f744bf1f0b631113aa8e9d2fbcfcca5a650ce0c60945774d18d233bed515d0
SSDEEP

12288:fEoDtED8RssKJq5M8/+Nj4eNtbtBj8sxk+GMn21jQAXIxF/BcEiw/3IWV4DcG7p:fEoDtED8Rs3j4eNZj8sxk+co/y

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4808	1564	WerFault.exe	80
3084	1564	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 4808	1564	c60bdf67b52de4cb286881e25382254656959d65149793819b064406623e6bfc.exe	83
PID 1564 wrote to memory of 4808	1564	c60bdf67b52de4cb286881e25382254656959d65149793819b064406623e6bfc.exe	83
PID 1564 wrote to memory of 4808	1564	c60bdf67b52de4cb286881e25382254656959d65149793819b064406623e6bfc.exe	83

C:\Users\Admin\AppData\Local\Temp\c60bdf67b52de4cb286881e25382254656959d65149793819b064406623e6bfc.exe
"C:\Users\Admin\AppData\Local\Temp\c60bdf67b52de4cb286881e25382254656959d65149793819b064406623e6bfc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 256
  2⤵
  - Program crash
  PID:4808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 256
  2⤵
  - Program crash
  PID:3084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1564 -ip 1564
1⤵
PID:4644