599da9c06bb0c71392e4836a21e0a2e68db966a29e806d83608e818af40885d5

Analysis

max time kernel
170s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
10-02-2023 19:09

Target

599da9c06bb0c71392e4836a21e0a2e68db966a29e806d83608e818af40885d5.exe
Size

4.3MB
MD5

ae83f8b521d7ed9ed3b4b8552eaedca5
SHA1

26b43c62fa9b3edbccd47ba8965798505772a758
SHA256

599da9c06bb0c71392e4836a21e0a2e68db966a29e806d83608e818af40885d5
SHA512

10d16b99472805aa3352c94b875bb19b50d38ab57781b32c2aeb6d9654160f10188e35e53194c96d26b3fa038d6a23e40cd6eeac2f9af761b8283fc88796f05d
SSDEEP

98304:D1ijlRnWUcXlbs9UDFBqP2wSYOtgf+3S:pIK1I9UDU28OtgfcS

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
2352	1652	WerFault.exe	599da9c06bb0c71392e4836a21e0a2e68db966a29e806d83608e818af40885d5.exe
4424	1652	WerFault.exe	599da9c06bb0c71392e4836a21e0a2e68db966a29e806d83608e818af40885d5.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

599da9c06bb0c71392e4836a21e0a2e68db966a29e806d83608e818af40885d5.exe

description	pid	process	target process
PID 1652 wrote to memory of 2352	1652	599da9c06bb0c71392e4836a21e0a2e68db966a29e806d83608e818af40885d5.exe	WerFault.exe
PID 1652 wrote to memory of 2352	1652	599da9c06bb0c71392e4836a21e0a2e68db966a29e806d83608e818af40885d5.exe	WerFault.exe
PID 1652 wrote to memory of 2352	1652	599da9c06bb0c71392e4836a21e0a2e68db966a29e806d83608e818af40885d5.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\599da9c06bb0c71392e4836a21e0a2e68db966a29e806d83608e818af40885d5.exe
"C:\Users\Admin\AppData\Local\Temp\599da9c06bb0c71392e4836a21e0a2e68db966a29e806d83608e818af40885d5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 604
2⤵
- Program crash
PID:2352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 604
2⤵
- Program crash
PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1652 -ip 1652
1⤵
PID:2552

memory/1652-132-0x0000000000400000-0x0000000001A0C000-memory.dmp

Filesize
22.0MB

Download
memory/1652-133-0x0000000000400000-0x0000000001A0C000-memory.dmp

Filesize
22.0MB

Download
memory/1652-134-0x0000000000400000-0x0000000001A0C000-memory.dmp

Filesize
22.0MB

Download
memory/1652-135-0x0000000000400000-0x0000000001A0C000-memory.dmp

Filesize
22.0MB

Download
memory/1652-136-0x0000000000400000-0x0000000001A0C000-memory.dmp

Filesize
22.0MB

Download
memory/1652-137-0x0000000000400000-0x0000000001A0C000-memory.dmp

Filesize
22.0MB

Download
memory/1652-139-0x0000000000400000-0x0000000001A0C000-memory.dmp

Filesize
22.0MB

Download
memory/2352-138-0x0000000000000000-mapping.dmp

Download