7549d4a121e1e7b5dc056cebe025d1af3d8c03440cad9bb23697c3f9bc6d07a9

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 11:29

Target

56776169335b8d2db22dba1ae47629f3e3e73a9a1d4f2c9cc6c7bcdd99b5fff8.exe
Size

881KB
MD5

538339734064ab915d20e9d7ab7e4e88
SHA1

c3fbe017ac4aa17d574f055db689cabd1b8cfb2d
SHA256

56776169335b8d2db22dba1ae47629f3e3e73a9a1d4f2c9cc6c7bcdd99b5fff8
SHA512

bbeb87174b9b9b4179ba1752417240883c999659f275fb8bdcf705b3c981928e39e51abdaa610c51bdc7f57fe33a6e0c44232b7e020b1fe8441f5f1610b7a96d
SSDEEP

12288:7ryVwGQ4bWldcKgyr8hFY+TAUd7p+puZ9:7rcwGZbedcFyr+d7pdZ9

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4556	4472	WerFault.exe	83
976	4472	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 4556	4472	56776169335b8d2db22dba1ae47629f3e3e73a9a1d4f2c9cc6c7bcdd99b5fff8.exe	88
PID 4472 wrote to memory of 4556	4472	56776169335b8d2db22dba1ae47629f3e3e73a9a1d4f2c9cc6c7bcdd99b5fff8.exe	88
PID 4472 wrote to memory of 4556	4472	56776169335b8d2db22dba1ae47629f3e3e73a9a1d4f2c9cc6c7bcdd99b5fff8.exe	88

C:\Users\Admin\AppData\Local\Temp\56776169335b8d2db22dba1ae47629f3e3e73a9a1d4f2c9cc6c7bcdd99b5fff8.exe
"C:\Users\Admin\AppData\Local\Temp\56776169335b8d2db22dba1ae47629f3e3e73a9a1d4f2c9cc6c7bcdd99b5fff8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 224
  2⤵
  - Program crash
  PID:4556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 224
  2⤵
  - Program crash
  PID:976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4472 -ip 4472
1⤵
PID:2432