42c4cae0332eb6bbce50f4a56ae2c8dc596c934a4758cb6e0e919c1ea60026ca

Analysis

max time kernel
199s
max time network
216s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 18:45

Target

42c4cae0332eb6bbce50f4a56ae2c8dc596c934a4758cb6e0e919c1ea60026ca.exe
Size

5KB
MD5

5b2c401ad515c6eade79dcf0554f311f
SHA1

2fc27645f2cac11ee05cd17cfb025086058a8661
SHA256

42c4cae0332eb6bbce50f4a56ae2c8dc596c934a4758cb6e0e919c1ea60026ca
SHA512

5ae4b20af284d3de9f1e31d12855cf4d2495ab7af2c7bb8d9c12f44ff8e6d59ea26d046b0e2517c1b643962428372a38c6220cca03723eee102432e3b183e48a
SSDEEP

48:S8lXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7tKRuqSxp:lWLkFfNnOKYloIQ2pm2pbYSexE

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1064	1816	WerFault.exe	22
3036	1816	WerFault.exe	22

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 1064	1816	42c4cae0332eb6bbce50f4a56ae2c8dc596c934a4758cb6e0e919c1ea60026ca.exe	87
PID 1816 wrote to memory of 1064	1816	42c4cae0332eb6bbce50f4a56ae2c8dc596c934a4758cb6e0e919c1ea60026ca.exe	87
PID 1816 wrote to memory of 1064	1816	42c4cae0332eb6bbce50f4a56ae2c8dc596c934a4758cb6e0e919c1ea60026ca.exe	87

C:\Users\Admin\AppData\Local\Temp\42c4cae0332eb6bbce50f4a56ae2c8dc596c934a4758cb6e0e919c1ea60026ca.exe
"C:\Users\Admin\AppData\Local\Temp\42c4cae0332eb6bbce50f4a56ae2c8dc596c934a4758cb6e0e919c1ea60026ca.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 224
  2⤵
  - Program crash
  PID:1064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 224
  2⤵
  - Program crash
  PID:3036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1816 -ip 1816
1⤵
PID:4528