3759a4136f3ab450b1c26121511bdfea101baf948b580af60516c8c2d5c7b900

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 17:48

Target
321ebf1c2e57ae454232ee12b6892164.exe
Size 383KB
Sample231225-wdf3wsgbbj
SHA256 3759a4136f3ab450b1c26121511bdfea101baf948b580af60516c8c2d5c7b900
MD5 321ebf1c2e57ae454232ee12b6892164
SHA1 db9f088a05203a6caf9656e59731f027adfe1bd0
SHA512 afc14c50480f173932da1c0f7d80ef7667eb95a8c8f66279f8481c4ef85a669c8c0ac15582b6762521b78d34af7510c374dd1b30e3fd14e1d273639b4c85e083
SSDEEP 6144:cf4h+LDGoTfJGkGiJxRuEGt/b2j7sZA7kasm5uqv8nmqSiAh1NSnc8xND+OXmKKg:cfDLDGoTfMLiJ544iSXPonj/D+O2KKg
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
816	2744	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2576	2744	321ebf1c2e57ae454232ee12b6892164.exe	21
PID 2744 wrote to memory of 2576	2744	321ebf1c2e57ae454232ee12b6892164.exe	21
PID 2744 wrote to memory of 2576	2744	321ebf1c2e57ae454232ee12b6892164.exe	21

C:\Users\Admin\AppData\Local\Temp\321ebf1c2e57ae454232ee12b6892164.exe
"C:\Users\Admin\AppData\Local\Temp\321ebf1c2e57ae454232ee12b6892164.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Users\Admin\AppData\Local\Temp\321ebf1c2e57ae454232ee12b6892164.exe
  "C:\Users\Admin\AppData\Local\Temp\321ebf1c2e57ae454232ee12b6892164.exe"
  2⤵
  PID:2576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 356
  2⤵
  - Program crash
  PID:816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2744 -ip 2744
1⤵
PID:892

memory/2744-2-0x0000000000A50000-0x0000000000A52000-memory.dmp

Download

memory/2744-1-0x00000000000A0000-0x00000000001A0000-memory.dmp

Download