0ab39ea5cdd161ea1ef3d2a52034db36a2475cf7ab4de349d0bd26b989f7816d

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 08:28

Target

11fe19924ad1a7851d2c9c4de70ac075.exe
Size

102KB
MD5

11fe19924ad1a7851d2c9c4de70ac075
SHA1

481f2b655927c217b0ab74fea29ea05d9fc3f680
SHA256

0ab39ea5cdd161ea1ef3d2a52034db36a2475cf7ab4de349d0bd26b989f7816d
SHA512

93a1049d812b315e3f9e46238758b2e52a54623c768b01f5c650e35c51368de853f4d7d98fd1996843d4e7bcc780e1894cf50323de61f9d37a4a63db7f2236b0
SSDEEP

1536:aS9km6KZ8ZAxB6IY1u2uuCeiMTEcGTsI/QDzNx62wlf0jfgLR1H:mmz8ZuB6JYqX7VA/w62wVnLR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
628	4588	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 628	4588	11fe19924ad1a7851d2c9c4de70ac075.exe	91
PID 4588 wrote to memory of 628	4588	11fe19924ad1a7851d2c9c4de70ac075.exe	91
PID 4588 wrote to memory of 628	4588	11fe19924ad1a7851d2c9c4de70ac075.exe	91

C:\Users\Admin\AppData\Local\Temp\11fe19924ad1a7851d2c9c4de70ac075.exe
"C:\Users\Admin\AppData\Local\Temp\11fe19924ad1a7851d2c9c4de70ac075.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 480
  2⤵
  - Program crash
  PID:628

memory/4588-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download