8172a6faec609addf0bf63a87b52dff0f638aa11d0f3676ad8fe431b62271a2c

Analysis

max time kernel
150s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 09:35

Target

644073bd6d88506db27f09293f8b269b.exe
Size

716KB
MD5

644073bd6d88506db27f09293f8b269b
SHA1

8b60e42f080cf00e0182dcb3fed45d2aaedd8d99
SHA256

8172a6faec609addf0bf63a87b52dff0f638aa11d0f3676ad8fe431b62271a2c
SHA512

db4f212cb1307f200dc2895f23fce88a2fb58287206bf8cab3adc1979ec91d04ed369cd1778cfbe4df3ea96b4fa5f6694fe8113ce21855e57d99ac627c4ca90c
SSDEEP

12288:PkFDob8apwzzU/KoV534/SYNVbY/2ToCfD4cxDnz1BhhP9bEIVQq183ewyxodLko:cF8Qzwic4SgY/EfMctbh9RBo

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3260	648	WerFault.exe	88
2920	648	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 3260	648	644073bd6d88506db27f09293f8b269b.exe	93
PID 648 wrote to memory of 3260	648	644073bd6d88506db27f09293f8b269b.exe	93
PID 648 wrote to memory of 3260	648	644073bd6d88506db27f09293f8b269b.exe	93

C:\Users\Admin\AppData\Local\Temp\644073bd6d88506db27f09293f8b269b.exe
"C:\Users\Admin\AppData\Local\Temp\644073bd6d88506db27f09293f8b269b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 224
  2⤵
  - Program crash
  PID:3260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 224
  2⤵
  - Program crash
  PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 648 -ip 648
1⤵
PID:1988

memory/648-0-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/648-1-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download