0479e28dee58e81df2212ef274827904398b9204e5b69050b6b08a46295f356c

Analysis

max time kernel
163s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 22:05

Target

052224582fd3c060d0c4d02a74163d64.exe
Size

389KB
MD5

052224582fd3c060d0c4d02a74163d64
SHA1

d05f3f182517dd0807f8f153329a6188ac3cbe4b
SHA256

0479e28dee58e81df2212ef274827904398b9204e5b69050b6b08a46295f356c
SHA512

4ea68a9ff5121e0d9ac3169634cb966ad761a98b09c30f75eb75dc2099fca2392978c852ca8cef337110eef96bced26beeb6c9841fd2b10ff688cd8f13560af0
SSDEEP

12288:eawKNw5PaUkBlErmSWx4X8Vx2iNpqa9vSHKHC8L/ZgR6v:6hFwkFWx4XAAuoYvJi8L/Zf

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
264	3440	WerFault.exe	88
4700	3440	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 264	3440	052224582fd3c060d0c4d02a74163d64.exe	96
PID 3440 wrote to memory of 264	3440	052224582fd3c060d0c4d02a74163d64.exe	96
PID 3440 wrote to memory of 264	3440	052224582fd3c060d0c4d02a74163d64.exe	96

C:\Users\Admin\AppData\Local\Temp\052224582fd3c060d0c4d02a74163d64.exe
"C:\Users\Admin\AppData\Local\Temp\052224582fd3c060d0c4d02a74163d64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 224
  2⤵
  - Program crash
  PID:264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 224
  2⤵
  - Program crash
  PID:4700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3440 -ip 3440
1⤵
PID:608

memory/3440-0-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3440-1-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download