537a1b1e9a633875a74664967b2e62803f01b619fb26df9b4762b6795ee1b0ec

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 18:26

Target
346c1f083ba87535c999f17587d0d8b9.exe
Size 252KB
Sample231225-w3f47aebc7
SHA256 537a1b1e9a633875a74664967b2e62803f01b619fb26df9b4762b6795ee1b0ec
MD5 346c1f083ba87535c999f17587d0d8b9
SHA1 82a6caee2df88f4944f0f144e70f8d70675ec45e
SHA512 086617b903ad3ae3c4145a9b3f122e560c64f4f0ef7a153b980f35213fa58ff5d9d480956502183ba1f310dbe0337efb81997d0f2b16a1bf751ad78935a8577b
SSDEEP 6144:sd53TvpHeIl0m7YIK9fdiqEOfdaEujuUNrYnKX2xB3ijwOlSMJIZ+:sd53TvpHeIl0mkIE15yNrYnKXwpShJI4
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
392	2192	WerFault.exe	34

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 3744	2192	346c1f083ba87535c999f17587d0d8b9.exe	89
PID 2192 wrote to memory of 3744	2192	346c1f083ba87535c999f17587d0d8b9.exe	89
PID 2192 wrote to memory of 3744	2192	346c1f083ba87535c999f17587d0d8b9.exe	89

C:\Users\Admin\AppData\Local\Temp\346c1f083ba87535c999f17587d0d8b9.exe
"C:\Users\Admin\AppData\Local\Temp\346c1f083ba87535c999f17587d0d8b9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Users\Admin\AppData\Local\Temp\346c1f083ba87535c999f17587d0d8b9.exe
  "C:\Users\Admin\AppData\Local\Temp\346c1f083ba87535c999f17587d0d8b9.exe"
  2⤵
  PID:3744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 364
  2⤵
  - Program crash
  PID:392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2192 -ip 2192
1⤵
PID:2940

memory/2192-1-0x00000000000A0000-0x00000000001A0000-memory.dmp

Download

memory/2192-2-0x00000000008D0000-0x00000000008D2000-memory.dmp

Download