fdbdd3bde4ba2098ed4ed70183389c7cbc197cb7b00cf5ee88f495a69d41209c

Analysis

max time kernel
186s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 11:30

Target

6adf6809c9f64fc21f5e4e978e99ba6d.exe
Size

529KB
MD5

6adf6809c9f64fc21f5e4e978e99ba6d
SHA1

310b47a72e544cfdc01e0f104527e3a16cf7d999
SHA256

fdbdd3bde4ba2098ed4ed70183389c7cbc197cb7b00cf5ee88f495a69d41209c
SHA512

47792ccd835c0aad2e5034db67f6851706a720c6bc0e4ca76b7bd582864f506a8c824944b518639997bd0cfebb6be5a46cf22065a799a6b8fc9a059e7b62eff0
SSDEEP

12288:WQ652sstfrVAFuynA7FD65dIN5sCN9GObU1yitcavD9/Kp+OpSytEUqgnhP/56d:Wn4AFFp/C9U1yi5vx/KVpSaEUBnhPi

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2928	3288	WerFault.exe	61
3048	3288	WerFault.exe	61

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 2928	3288	6adf6809c9f64fc21f5e4e978e99ba6d.exe	94
PID 3288 wrote to memory of 2928	3288	6adf6809c9f64fc21f5e4e978e99ba6d.exe	94
PID 3288 wrote to memory of 2928	3288	6adf6809c9f64fc21f5e4e978e99ba6d.exe	94

C:\Users\Admin\AppData\Local\Temp\6adf6809c9f64fc21f5e4e978e99ba6d.exe
"C:\Users\Admin\AppData\Local\Temp\6adf6809c9f64fc21f5e4e978e99ba6d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 488
  2⤵
  - Program crash
  PID:2928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 488
  2⤵
  - Program crash
  PID:3048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3288 -ip 3288
1⤵
PID:4460

memory/3288-0-0x0000000000320000-0x00000000003A6000-memory.dmp

Filesize
536KB

Download