69f602b148675223f36ff4d77a55d9c2cd04003000f5d5e1b21b4c6c501be4ab

Analysis

max time kernel
150s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 12:20

Target

15011a95eb442061c9789d559081a785.exe
Size

530KB
MD5

15011a95eb442061c9789d559081a785
SHA1

37380c3f3ab7c373acce50c31d4f8f621eeb90cc
SHA256

69f602b148675223f36ff4d77a55d9c2cd04003000f5d5e1b21b4c6c501be4ab
SHA512

28720568b0a16c86961e668221f51636e0c8bb6592088217f5b8d895c10bf6ec9a4ab46885c83a12b201a73cab250e22164ddc3c3d0838b402b747a219a61cbf
SSDEEP

12288:io2JVedYmkqGFHLiPkUPxvdkIOCAyEnfXOl778eD55jjgUh4ldPTk8aGN/B6KB6F:io2JVedYmkqGFHLiPkUPxvdkIOCAyEnY

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4536	3408	WerFault.exe	82
2808	3408	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 4536	3408	15011a95eb442061c9789d559081a785.exe	85
PID 3408 wrote to memory of 4536	3408	15011a95eb442061c9789d559081a785.exe	85
PID 3408 wrote to memory of 4536	3408	15011a95eb442061c9789d559081a785.exe	85

C:\Users\Admin\AppData\Local\Temp\15011a95eb442061c9789d559081a785.exe
"C:\Users\Admin\AppData\Local\Temp\15011a95eb442061c9789d559081a785.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 380
  2⤵
  - Program crash
  PID:4536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 380
  2⤵
  - Program crash
  PID:2808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3408 -ip 3408
1⤵
PID:3156