6e318257ff61f8aeff03704c59af6d66f52b4ae7fe36ab8b715db00694cad13a

Analysis

max time kernel
100s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 15:12

Target

0332c0b39be14a0fbfbb0689bdd2027d.exe
Size

530KB
MD5

0332c0b39be14a0fbfbb0689bdd2027d
SHA1

cc98db2d9f83f7a7685219808ae9ae5414110747
SHA256

6e318257ff61f8aeff03704c59af6d66f52b4ae7fe36ab8b715db00694cad13a
SHA512

fd06c301590a05cb26c0026ce2a3f560a345cc2e63f563fe6958db48513994550e5f25d54f312be3c108c96645cf7cc41448fc5b05ca7a57aa15cfc6768b0a55
SSDEEP

6144:3FX9qqKGPBcwqh3SBL2S/93+RosoV9cVGP0mnGF1Q5QDNWmuSYNKFpqrT5phv:3ivGPOEv3+RRe9cVXbqyDNtIrbd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4608	2100	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 1544	2100	0332c0b39be14a0fbfbb0689bdd2027d.exe	87
PID 2100 wrote to memory of 1544	2100	0332c0b39be14a0fbfbb0689bdd2027d.exe	87
PID 2100 wrote to memory of 1544	2100	0332c0b39be14a0fbfbb0689bdd2027d.exe	87

C:\Users\Admin\AppData\Local\Temp\0332c0b39be14a0fbfbb0689bdd2027d.exe
"C:\Users\Admin\AppData\Local\Temp\0332c0b39be14a0fbfbb0689bdd2027d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\0332c0b39be14a0fbfbb0689bdd2027d.exe
  "C:\Users\Admin\AppData\Local\Temp\0332c0b39be14a0fbfbb0689bdd2027d.exe"
  2⤵
  PID:1544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 316
  2⤵
  - Program crash
  PID:4608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2100 -ip 2100
1⤵
PID:3508

memory/2100-1-0x00000000000A0000-0x00000000001A0000-memory.dmp

Filesize
1024KB

Download
memory/2100-2-0x00000000037B0000-0x00000000037B2000-memory.dmp

Filesize
8KB

Download