c61f7ecb6aa9aeb278a6dbf94a1525315ad0a226fcd51b698c07410ef84f11d1

Analysis

max time kernel
151s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 08:56

Target

61a77c73a5d5f80f4969dadd96694948.exe
Size

127KB
MD5

61a77c73a5d5f80f4969dadd96694948
SHA1

ab5ed67cf58204d78c3d0eb3c54ede9d89048df6
SHA256

c61f7ecb6aa9aeb278a6dbf94a1525315ad0a226fcd51b698c07410ef84f11d1
SHA512

802d6393bdffe8b2010e95e6d76de5855b88d3345ce4d9281bd669e635eb2c737d440300bd3ad891bc6c3a6c9c04132c11be21f2dcef4c5c822946d123fcb73e
SSDEEP

3072:PjY9FI+zeOKndRzAlSWc+SeLebsbJ3IQQ0jKNKSfL/U:PChzNsslSyRagbJ3IQQJ

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2320	3168	WerFault.exe	88
1300	3168	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 2320	3168	61a77c73a5d5f80f4969dadd96694948.exe	94
PID 3168 wrote to memory of 2320	3168	61a77c73a5d5f80f4969dadd96694948.exe	94
PID 3168 wrote to memory of 2320	3168	61a77c73a5d5f80f4969dadd96694948.exe	94

C:\Users\Admin\AppData\Local\Temp\61a77c73a5d5f80f4969dadd96694948.exe
"C:\Users\Admin\AppData\Local\Temp\61a77c73a5d5f80f4969dadd96694948.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 288
  2⤵
  - Program crash
  PID:2320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 288
  2⤵
  - Program crash
  PID:1300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3168 -ip 3168
1⤵
PID:2308

memory/3168-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3168-1-0x00000000006D0000-0x00000000006FE000-memory.dmp

Filesize
184KB

Download
memory/3168-2-0x00000000006D0000-0x00000000006FE000-memory.dmp

Filesize
184KB

Download