d60d4da2cfe120138a3fde66694b40ae2710cfc2af33cb7810b3a0e9b1663a4f

Analysis

max time kernel
139s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2023, 14:57

Target
KSPSService.exe
Size 22.1MB
Sample230930-sbkrhsdd21
SHA256 d60d4da2cfe120138a3fde66694b40ae2710cfc2af33cb7810b3a0e9b1663a4f
MD5 d113b3debc7e0a2da4369dd8d1dbad53
SHA1 78e17bd7e30c66aaef91a5b5fcb36a036a1074b7
SHA512 84a2b7c6992ab4b0a5c0ca9c25f78398d589de7b94a4986b186696d6b960e32c21ca04c1f7ea10590d0e468063cd3f475b78ecf43237b9071fd0b1a5d5b549f3
SSDEEP 393216:nEwZORKlcGk9wNM6lnFKYcjGnMCArFDJgbgrD07fesSOB50OoIhCwkbrSv271mL3:EwZOgbF6t1JgkrKmsSc5NodZnA2ZmL6c
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2472	536	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
536	KSPSService.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 4456	536	KSPSService.exe	86
PID 536 wrote to memory of 4456	536	KSPSService.exe	86
PID 536 wrote to memory of 4456	536	KSPSService.exe	86

C:\Users\Admin\AppData\Local\Temp\KSPSService.exe
"C:\Users\Admin\AppData\Local\Temp\KSPSService.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  PID:4456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 1076
  2⤵
  - Program crash
  PID:2472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 536 -ip 536
1⤵
PID:1976

memory/536-0-0x0000000000D40000-0x000000000106A000-memory.dmp

Download

memory/536-2-0x0000000076FB0000-0x000000007706F000-memory.dmp

Download

memory/536-3-0x0000000076FB0000-0x000000007706F000-memory.dmp

Download