99cb9ea998d774a077d760f6a767660a520bc882a73195b3cd0282c2e967fb13

Analysis

max time kernel
330s
max time network
378s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 00:28

Target
file.exe
Size 1.3MB
Sample221207-asdqeshf39
SHA256 99cb9ea998d774a077d760f6a767660a520bc882a73195b3cd0282c2e967fb13
MD5 49d3d360aa4d5801e3e6cf63d799c793
SHA1 520f5870394c9976db688f77bc651ff0a3935691
SHA512 55eb643cc689ae380570d104d0c504c97af75fc78c1ecf5f7258466e7e2a2d5797c6790821452075bd84843863f3c84b65cd29ece138466b00962ef3802f538b
SSDEEP 24576:pj4Pq3FyJga5jGIwtwS7TSNqAzjuY4+1ziRN+FtxA8Xc009GtfzZfCev5mF62X+E:pjsZJj5jG9WoTy72YlziRaK0+Gt1
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1448	3328	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 1448	3328	file.exe	86
PID 3328 wrote to memory of 1448	3328	file.exe	86
PID 3328 wrote to memory of 1448	3328	file.exe	86

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 416
  2⤵
  - Program crash
  PID:1448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3328 -ip 3328
1⤵
PID:2216