d2f2111e41282638738a99eb75d927a4f7a16482cb0f462d466446fe425fdec6

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 13:31

Target

21e6cbee73432dc4061a30993f007d7d.exe
Size

321KB
MD5

21e6cbee73432dc4061a30993f007d7d
SHA1

aeca261893e06634e82a90c33c6081b6cb17da2d
SHA256

d2f2111e41282638738a99eb75d927a4f7a16482cb0f462d466446fe425fdec6
SHA512

a865034cee468514aa41907bf6a708d0981bf0b9b7c6f801d317f0c151beb8f12baf4e0c548075b6358c06d6d8c09025c04df6f538149cdb61ff1e1aeae0168c
SSDEEP

6144:OTj1OTEKnsub1upoH7td/tQqG56Prd3Z5NBA3r14lJDNIl:OFOoKnsub6oHprG5+3a7STY

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1676	4984	WerFault.exe	87
644	4984	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 1676	4984	21e6cbee73432dc4061a30993f007d7d.exe	92
PID 4984 wrote to memory of 1676	4984	21e6cbee73432dc4061a30993f007d7d.exe	92
PID 4984 wrote to memory of 1676	4984	21e6cbee73432dc4061a30993f007d7d.exe	92

C:\Users\Admin\AppData\Local\Temp\21e6cbee73432dc4061a30993f007d7d.exe
"C:\Users\Admin\AppData\Local\Temp\21e6cbee73432dc4061a30993f007d7d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 332
  2⤵
  - Program crash
  PID:1676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 332
  2⤵
  - Program crash
  PID:644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4984 -ip 4984
1⤵
PID:4548

memory/4984-0-0x0000000000980000-0x00000000009D5000-memory.dmp

Filesize
340KB

Download