f01d2c5aebf46bdef53a7352f8c7f3f7e3a4b4b44c3a059a7b361873830da9d3

Analysis

max time kernel
148s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 10:50

Target

68be3156570181b687a2c673f5b094db.exe
Size

76KB
MD5

68be3156570181b687a2c673f5b094db
SHA1

6bef3ac5ba1e8dcfe6b30a32293e93952ec87322
SHA256

f01d2c5aebf46bdef53a7352f8c7f3f7e3a4b4b44c3a059a7b361873830da9d3
SHA512

c8f64a2b61bfa72a560dbccb10dc178098df86943aa530825ac4575c3f941f32f4f97dd7ffd680b8d9f43bd508ca29ae52cbe6423b23bf616eacc6eb1a313b51
SSDEEP

1536:m/ePyXHZ7DA4BfBrmTiXvvvUgbFNCuACP1DIgN:EeSHZ7DTBfBrB/UgbFNCuAq2C

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1124	4576	WerFault.exe	37
2736	4576	WerFault.exe	37

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 1124	4576	68be3156570181b687a2c673f5b094db.exe	95
PID 4576 wrote to memory of 1124	4576	68be3156570181b687a2c673f5b094db.exe	95
PID 4576 wrote to memory of 1124	4576	68be3156570181b687a2c673f5b094db.exe	95

C:\Users\Admin\AppData\Local\Temp\68be3156570181b687a2c673f5b094db.exe
"C:\Users\Admin\AppData\Local\Temp\68be3156570181b687a2c673f5b094db.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 312
  2⤵
  - Program crash
  PID:1124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 312
  2⤵
  - Program crash
  PID:2736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4576 -ip 4576
1⤵
PID:2168

memory/4576-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4576-1-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download