11e79b9f2d41e5e0eab7a875dfb0ccd87b0cbd2d05fc57dad922977daf1515fe

Analysis

max time kernel
133s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 14:42

Target

266b5da554fe1536ddd9ee9e4ae230fd.exe
Size

566KB
MD5

266b5da554fe1536ddd9ee9e4ae230fd
SHA1

391063bd54189759b2f5e9cf9d897172dacb9ebc
SHA256

11e79b9f2d41e5e0eab7a875dfb0ccd87b0cbd2d05fc57dad922977daf1515fe
SHA512

f635f6fbeedfa1034819d587a72adc7e2ce948a9a09fb52480a787d05d5051b50e316298a097e7dd35ab3d7c767609a5114875e4c73b724b6f62972d7c1644ee
SSDEEP

6144:FiV4iDsBPMZXTgcrh9tjvBl5nWqiLR2UsWir6wYDitbfAZ6UpCD1U8vXSrWt3pDp:FeDsdggcZvBzn5uRd6r+2k60CDuS9H

Score

3^/10

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4368	4732	WerFault.exe	87
3196	756	WerFault.exe	99
876	2712	WerFault.exe	98

Suspicious use of UnmapMainImage 3 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 2712	4732	266b5da554fe1536ddd9ee9e4ae230fd.exe	98
PID 4732 wrote to memory of 2712	4732	266b5da554fe1536ddd9ee9e4ae230fd.exe	98
PID 4732 wrote to memory of 2712	4732	266b5da554fe1536ddd9ee9e4ae230fd.exe	98
PID 4732 wrote to memory of 756	4732	266b5da554fe1536ddd9ee9e4ae230fd.exe	99
PID 4732 wrote to memory of 756	4732	266b5da554fe1536ddd9ee9e4ae230fd.exe	99
PID 4732 wrote to memory of 756	4732	266b5da554fe1536ddd9ee9e4ae230fd.exe	99

C:\Users\Admin\AppData\Local\Temp\266b5da554fe1536ddd9ee9e4ae230fd.exe
"C:\Users\Admin\AppData\Local\Temp\266b5da554fe1536ddd9ee9e4ae230fd.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 600
  2⤵
  - Program crash
  PID:4368
- C:\Users\Admin\AppData\Local\Temp\266b5da554fe1536ddd9ee9e4ae230fd.exe
  start
  2⤵
  - Suspicious use of UnmapMainImage
  PID:2712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 568
    3⤵
    - Program crash
    PID:876
- C:\Users\Admin\AppData\Local\Temp\266b5da554fe1536ddd9ee9e4ae230fd.exe
  watch
  2⤵
  - Suspicious use of UnmapMainImage
  PID:756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 568
    3⤵
    - Program crash
    PID:3196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4732 -ip 4732
1⤵
PID:1056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 756 -ip 756
1⤵
PID:3980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2712 -ip 2712
1⤵
PID:4464

memory/756-3-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/756-6-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2712-4-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2712-5-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/4732-0-0x0000000000710000-0x000000000072F000-memory.dmp

Filesize
124KB

Download
memory/4732-1-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/4732-2-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download