1edbf1fb5dd38ced0144df0ae56a2508c648a9aa0779e95097a05136c7933c88

Analysis

max time kernel
162s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 12:15

Target

1edbf1fb5dd38ced0144df0ae56a2508c648a9aa0779e95097a05136c7933c88.exe
Size

1.2MB
MD5

83998917930abcb867bb68705ae2eb95
SHA1

880debd790117d0015f763c2b3b3b3e9d4479364
SHA256

1edbf1fb5dd38ced0144df0ae56a2508c648a9aa0779e95097a05136c7933c88
SHA512

7fcab2f782734515a1f9ae27259d6e7d3f9df02e8194f268b61f62438e481c951e8cb25ce1e08e2d11f58732d4938892caa7c447155eafccd8f69dc3509bc2ee
SSDEEP

24576:HOmq1LeEofsiRjM3xpVUoEJNuSIgPFGx+znpfuZ:HOmq1iEviRIFvyNhrF1znFo

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3780	1132	WerFault.exe	85
864	1132	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 3780	1132	1edbf1fb5dd38ced0144df0ae56a2508c648a9aa0779e95097a05136c7933c88.exe	92
PID 1132 wrote to memory of 3780	1132	1edbf1fb5dd38ced0144df0ae56a2508c648a9aa0779e95097a05136c7933c88.exe	92
PID 1132 wrote to memory of 3780	1132	1edbf1fb5dd38ced0144df0ae56a2508c648a9aa0779e95097a05136c7933c88.exe	92

C:\Users\Admin\AppData\Local\Temp\1edbf1fb5dd38ced0144df0ae56a2508c648a9aa0779e95097a05136c7933c88.exe
"C:\Users\Admin\AppData\Local\Temp\1edbf1fb5dd38ced0144df0ae56a2508c648a9aa0779e95097a05136c7933c88.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 440
  2⤵
  - Program crash
  PID:3780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 440
  2⤵
  - Program crash
  PID:864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1132 -ip 1132
1⤵
PID:4104