a36d67d1ba71fbd73e82e40cb2813c92be5997d0255fadbaf77444024517bb9b

Analysis

max time kernel
159s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10-12-2022 09:28

Target

2092-139-0x0000000000720000-0x000000000074E000-memory.exe
Size

184KB
MD5

b13fdad35342af3b90b9f2697b986827
SHA1

51f7f124daaec6268399714841545e5ff04d3409
SHA256

a36d67d1ba71fbd73e82e40cb2813c92be5997d0255fadbaf77444024517bb9b
SHA512

ad79f01b0e6016f293a256ba52210ba51d0bc17bc503d5302bf3410dff30270109670caec238478c314f1ab7fc3780ea85b8471511ecfc7c7b501e5b33b3964e
SSDEEP

3072:cNYM6B+svOQbvFhTJWMS4KNsbJlC5a2La//wsog7RzeS4wSBgO:ccEsGghTVgSJMo2i4snpeH

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4716 3368 WerFault.exe 2092-139-0x0000000000720000-0x000000000074E000-memory.exe

pid	pid_target	process	target process
4716	3368	WerFault.exe	2092-139-0x0000000000720000-0x000000000074E000-memory.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2092-139-0x0000000000720000-0x000000000074E000-memory.exe

description	pid	process	target process
PID 3368 wrote to memory of 4716	3368	2092-139-0x0000000000720000-0x000000000074E000-memory.exe	WerFault.exe
PID 3368 wrote to memory of 4716	3368	2092-139-0x0000000000720000-0x000000000074E000-memory.exe	WerFault.exe
PID 3368 wrote to memory of 4716	3368	2092-139-0x0000000000720000-0x000000000074E000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2092-139-0x0000000000720000-0x000000000074E000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2092-139-0x0000000000720000-0x000000000074E000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 220
2⤵
- Program crash
PID:4716