251674fd02565616303ef51957bdda70d4c69434059b176c975cf4d2904f8e79

Analysis

max time kernel
144s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2023 13:44

Target

2752-2-0x0000000000400000-0x000000000040B000-memory.exe
Size

44KB
MD5

067358f3b02b484bfb88efceff5fa369
SHA1

0a8e1512c54102de8a7575455ca6c004f2889119
SHA256

251674fd02565616303ef51957bdda70d4c69434059b176c975cf4d2904f8e79
SHA512

ff252efe4ac9c6be17f9023c2c3a18b1d66b89a65f3e1084c008b8f1ed177dca1470d4bc2b5cc399d8140aa3075c0f04d75cb995071862687be9efc06c2ed63c
SSDEEP

384:xhnyaz2ypQY5ZkVtqvhyY3Q6oVxYJaCY3WqPakgUt11iyBrUo7MgImBH+Te:GnHY5Zkf4hyYtoVxYHm1oUt1vnhBl

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
3360	3000	WerFault.exe	2752-2-0x0000000000400000-0x000000000040B000-memory.exe
320	3000	WerFault.exe	2752-2-0x0000000000400000-0x000000000040B000-memory.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2752-2-0x0000000000400000-0x000000000040B000-memory.exe

description	pid	process	target process
PID 3000 wrote to memory of 3360	3000	2752-2-0x0000000000400000-0x000000000040B000-memory.exe	WerFault.exe
PID 3000 wrote to memory of 3360	3000	2752-2-0x0000000000400000-0x000000000040B000-memory.exe	WerFault.exe
PID 3000 wrote to memory of 3360	3000	2752-2-0x0000000000400000-0x000000000040B000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2752-2-0x0000000000400000-0x000000000040B000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2752-2-0x0000000000400000-0x000000000040B000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 340
2⤵
- Program crash
PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 340
2⤵
- Program crash
PID:320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3000 -ip 3000
1⤵
PID:4540

memory/3000-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download