c46abf12a156746814de0c1f3a9f3db912974541d1adb980c82390327b38004e

Analysis

max time kernel
159s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 12:50

Target

6fd18c75ccb994294610654161c503cd.exe
Size

321KB
MD5

6fd18c75ccb994294610654161c503cd
SHA1

473dd5396524bb6c56050267d18758f5006dcf5f
SHA256

c46abf12a156746814de0c1f3a9f3db912974541d1adb980c82390327b38004e
SHA512

ca1e449bca69c028331c06fcb63b5abdb56af5d2099b73bdd0c30c6af34b2bbf11a67ea3fedf8f1d4eef326545dc52ecac4b3f401e61031da88c65da477fd120
SSDEEP

6144:rNxa/EJddK7vwK1poH7td/tQqG56Prd3Z5NBA3r12Ii:rO/YddK7vw0oHprG5+3a7O

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2676	2944	WerFault.exe	55
1628	2944	WerFault.exe	55

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2676	2944	6fd18c75ccb994294610654161c503cd.exe	96
PID 2944 wrote to memory of 2676	2944	6fd18c75ccb994294610654161c503cd.exe	96
PID 2944 wrote to memory of 2676	2944	6fd18c75ccb994294610654161c503cd.exe	96

C:\Users\Admin\AppData\Local\Temp\6fd18c75ccb994294610654161c503cd.exe
"C:\Users\Admin\AppData\Local\Temp\6fd18c75ccb994294610654161c503cd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 332
  2⤵
  - Program crash
  PID:2676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 332
  2⤵
  - Program crash
  PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 2944 -ip 2944
1⤵
PID:3552

memory/2944-0-0x0000000000110000-0x0000000000165000-memory.dmp

Filesize
340KB

Download