408e457a35cad3a5cee9ee3614c55cd57f83c254353c9c5caef65db7cb9b59d8

Analysis

max time kernel
145s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 14:58

Target

029fd7384e45c8848df0e6bfdaf78e42.exe
Size

240KB
MD5

029fd7384e45c8848df0e6bfdaf78e42
SHA1

6ce1d59109cee806b19e38ac21068ec03f1517df
SHA256

408e457a35cad3a5cee9ee3614c55cd57f83c254353c9c5caef65db7cb9b59d8
SHA512

95e7d59d163eb1ba52b34d4e3f3b77afaea347dd27a4f3b3a89e6d07eefbea5611ff11523f21ad6cbc2f8d8c2bb7eb731a72924ab838c6895e97d95450508d56
SSDEEP

3072:A7/64aQcwAAvVytLpxQrFfznmRpJmaPJC2rHy6FFp0jD:s6avstLIrZzOpCvcb+D

Score

3^/10

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3324	4676	WerFault.exe	56
4920	4676	WerFault.exe	56
4004	4676	WerFault.exe	56
3932	4676	WerFault.exe	56

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 3324	4676	029fd7384e45c8848df0e6bfdaf78e42.exe	91
PID 4676 wrote to memory of 3324	4676	029fd7384e45c8848df0e6bfdaf78e42.exe	91
PID 4676 wrote to memory of 3324	4676	029fd7384e45c8848df0e6bfdaf78e42.exe	91

C:\Users\Admin\AppData\Local\Temp\029fd7384e45c8848df0e6bfdaf78e42.exe
"C:\Users\Admin\AppData\Local\Temp\029fd7384e45c8848df0e6bfdaf78e42.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 264
  2⤵
  - Program crash
  PID:3324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 264
  2⤵
  - Program crash
  PID:4920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 264
  2⤵
  - Program crash
  PID:4004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 252
  2⤵
  - Program crash
  PID:3932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4676 -ip 4676
1⤵
PID:2440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4676 -ip 4676
1⤵
PID:1456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4676 -ip 4676
1⤵
PID:4348

memory/4676-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/4676-1-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download