01bc3f4a1c16f154eb99aabc8e2c012ed72bfbaa5c56bb1b66768f3b8f684577

Analysis

max time kernel
133s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 21:34

Target

01bc3f4a1c16f154eb99aabc8e2c012ed72bfbaa5c56bb1b66768f3b8f684577.exe
Size

113KB
MD5

5daabe3ea15c3bb2b678745089b1e4c0
SHA1

9bc78e75e2ced32a383c6e04ef5daf787a3a4d8b
SHA256

01bc3f4a1c16f154eb99aabc8e2c012ed72bfbaa5c56bb1b66768f3b8f684577
SHA512

cfb23dbb0c9b071bbc56d2899a4eca8d344a7453ad339cc52f4b1a749dd20ae7de70bb3afe316dcc07b218eb04033bb8109791adc24624c92677fa14834b26bf
SSDEEP

1536:qiinKRUU2csfWQ42ZRsy/sJ1GYrcSTwnQOG4N/guze0DzzzzzzzzzzzGK/Dzzzz9:qiDRUU2Jv/ZIJ1ZN0nQMzf2S2j2v

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2380	5056	WerFault.exe	82
4564	5056	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 2380	5056	01bc3f4a1c16f154eb99aabc8e2c012ed72bfbaa5c56bb1b66768f3b8f684577.exe	94
PID 5056 wrote to memory of 2380	5056	01bc3f4a1c16f154eb99aabc8e2c012ed72bfbaa5c56bb1b66768f3b8f684577.exe	94
PID 5056 wrote to memory of 2380	5056	01bc3f4a1c16f154eb99aabc8e2c012ed72bfbaa5c56bb1b66768f3b8f684577.exe	94

C:\Users\Admin\AppData\Local\Temp\01bc3f4a1c16f154eb99aabc8e2c012ed72bfbaa5c56bb1b66768f3b8f684577.exe
"C:\Users\Admin\AppData\Local\Temp\01bc3f4a1c16f154eb99aabc8e2c012ed72bfbaa5c56bb1b66768f3b8f684577.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 1076
  2⤵
  - Program crash
  PID:2380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 1076
  2⤵
  - Program crash
  PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5056 -ip 5056
1⤵
PID:1196

memory/5056-0-0x0000000074A80000-0x0000000075230000-memory.dmp

Filesize
7.7MB

Download
memory/5056-1-0x0000000000B60000-0x0000000000B82000-memory.dmp

Filesize
136KB

Download
memory/5056-2-0x0000000005510000-0x00000000055AC000-memory.dmp

Filesize
624KB

Download
memory/5056-3-0x0000000005B90000-0x0000000006134000-memory.dmp

Filesize
5.6MB

Download
memory/5056-4-0x0000000005680000-0x0000000005712000-memory.dmp

Filesize
584KB

Download
memory/5056-5-0x0000000074A80000-0x0000000075230000-memory.dmp

Filesize
7.7MB

Download
memory/5056-6-0x0000000005610000-0x0000000005620000-memory.dmp

Filesize
64KB

Download
memory/5056-7-0x0000000005630000-0x000000000563A000-memory.dmp

Filesize
40KB

Download
memory/5056-8-0x0000000005780000-0x00000000057D6000-memory.dmp

Filesize
344KB

Download
memory/5056-9-0x0000000005610000-0x0000000005620000-memory.dmp

Filesize
64KB

Download
memory/5056-10-0x0000000074A80000-0x0000000075230000-memory.dmp

Filesize
7.7MB

Download