8d167481e6f45383f10a657039cfa2bfaa4a29ccf4be55615a1fc57241e26c2d

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 02:52

Target
4e05c01fc9dcf68548c55e81728501b4.exe
Size 336KB
Sample231226-dc2dbsbdhr
SHA256 8d167481e6f45383f10a657039cfa2bfaa4a29ccf4be55615a1fc57241e26c2d
MD5 4e05c01fc9dcf68548c55e81728501b4
SHA1 d7cb68868ecbc1d386823be8f3c11ce53724cb8d
SHA512 afa52666fb6eca90c5ab02389f8495e25d4dbd55864745f22e9439c1d1f2fbdfdc0252fdc5c31e72caa99103bfc3afcf435450c3d64258145b1ab3d971f485e7
SSDEEP 6144:c29wiaEfBcDqh3SB/igBKjB9/42u/wISrIRMK+5SS3bL:c5XEfOZ/5KjG4TLQSH
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5056	1624	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 2716	1624	4e05c01fc9dcf68548c55e81728501b4.exe	90
PID 1624 wrote to memory of 2716	1624	4e05c01fc9dcf68548c55e81728501b4.exe	90
PID 1624 wrote to memory of 2716	1624	4e05c01fc9dcf68548c55e81728501b4.exe	90

C:\Users\Admin\AppData\Local\Temp\4e05c01fc9dcf68548c55e81728501b4.exe
"C:\Users\Admin\AppData\Local\Temp\4e05c01fc9dcf68548c55e81728501b4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Users\Admin\AppData\Local\Temp\4e05c01fc9dcf68548c55e81728501b4.exe
  "C:\Users\Admin\AppData\Local\Temp\4e05c01fc9dcf68548c55e81728501b4.exe"
  2⤵
  PID:2716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 324
  2⤵
  - Program crash
  PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1624 -ip 1624
1⤵
PID:3312

memory/1624-1-0x00000000000A0000-0x00000000001A0000-memory.dmp

Download

memory/1624-2-0x00000000036A0000-0x00000000036A2000-memory.dmp

Download