68097762e47e4ee48c7ab262abafc06a62dc303248d635f6b0bb46198ad0795b

Analysis

max time kernel
156s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 13:44

Target

CMipsPJ v3.002.exe
Size

7.7MB
MD5

361e92ba3ac8266a87ca272dc9f50b72
SHA1

d3ee38cffc4cf927cb886c05721e951b0060ac22
SHA256

68097762e47e4ee48c7ab262abafc06a62dc303248d635f6b0bb46198ad0795b
SHA512

4e4096a152ddc57204e5b48e3e9242d9f16ca91e9a8662daff776ff2e38af81311906c1448843c1a6f9f9821849153c1918d2fc162e509d819e23565cb58dfac
SSDEEP

196608:nQBaDVedbmWlSP5VwMDaYtuicJqqURBVlz:QBaDYkaMDaYtCax

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4428	3880	WerFault.exe	84

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 324	3880	CMipsPJ v3.002.exe	86
PID 3880 wrote to memory of 324	3880	CMipsPJ v3.002.exe	86

C:\Users\Admin\AppData\Local\Temp\CMipsPJ v3.002.exe
"C:\Users\Admin\AppData\Local\Temp\CMipsPJ v3.002.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 1064
  2⤵
  - Program crash
  PID:4428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3880 -ip 3880
1⤵
PID:2052

memory/3880-0-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/3880-1-0x0000000000400000-0x0000000002A36000-memory.dmp

Filesize
38.2MB

Download
memory/3880-2-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/3880-3-0x0000000000400000-0x0000000002A36000-memory.dmp

Filesize
38.2MB

Download
memory/3880-4-0x0000000000400000-0x0000000002A36000-memory.dmp

Filesize
38.2MB

Download
memory/3880-5-0x0000000000400000-0x0000000002A36000-memory.dmp

Filesize
38.2MB

Download
memory/3880-6-0x0000000000400000-0x0000000002A36000-memory.dmp

Filesize
38.2MB

Download