37e3ba716419e282050494f9eaacaa5221965e6a22363d7f65e855e97eaee433

Analysis

max time kernel
143s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 14:26

Target

758402654c735db95755f4bc2537aba0.exe
Size

20KB
MD5

758402654c735db95755f4bc2537aba0
SHA1

aab7385d89a9ef4ec6203111d42c1b59c2103161
SHA256

37e3ba716419e282050494f9eaacaa5221965e6a22363d7f65e855e97eaee433
SHA512

f509614e2e8b4ad5ce3a76eb793be1aa742439c4991fa71b73445bec55683dd4c3d1163a41f5d2fbf94536ede4d8c248e37cf2195657b8c31ea99b1e08b31beb
SSDEEP

384:aS4hQ6Oud9qGNEhRbeq/KnUUXbZ6Ftps2bOBZ4Bwg:alelud9qGNEXtLA4psIOBZ4Wg

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2376	1484	WerFault.exe	87
2572	1484	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 2376	1484	758402654c735db95755f4bc2537aba0.exe	94
PID 1484 wrote to memory of 2376	1484	758402654c735db95755f4bc2537aba0.exe	94
PID 1484 wrote to memory of 2376	1484	758402654c735db95755f4bc2537aba0.exe	94

C:\Users\Admin\AppData\Local\Temp\758402654c735db95755f4bc2537aba0.exe
"C:\Users\Admin\AppData\Local\Temp\758402654c735db95755f4bc2537aba0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 264
  2⤵
  - Program crash
  PID:2376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 264
  2⤵
  - Program crash
  PID:2572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1484 -ip 1484
1⤵
PID:3136

memory/1484-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1484-1-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download