4796e12d5a33b3b717b0ddc65286b9de7479e86bc91cc0bdb843722a5b62951b

Analysis

max time kernel
136s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 23:41

Target
0745a91ca11c4c208560564ec24451d7.exe
Size 324KB
Sample231229-3prgbsbhb9
SHA256 4796e12d5a33b3b717b0ddc65286b9de7479e86bc91cc0bdb843722a5b62951b
MD5 0745a91ca11c4c208560564ec24451d7
SHA1 cd7d14c1b17841b118e4e1f1fc473612654f2f31
SHA512 dfcf69496dd86e8e5d379c530899536a7a64c0ed5b4c05bac8282fee655541ea4d69df80e9d41026d260118825e8e0cbb64e8f8d2fbf0d1e0f868edfe72a5466
SSDEEP 6144:oBrf0xh3Hfr5YwuLpVtE/qpDVl2HwW429mdix4KRYLCeA8ntOOrdT0y:+rf0P3HD5YQ/qp5UHwWmix4TLCQXrd7
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3588	1924	WerFault.exe	12

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2604	1924	0745a91ca11c4c208560564ec24451d7.exe	21
PID 1924 wrote to memory of 2604	1924	0745a91ca11c4c208560564ec24451d7.exe	21
PID 1924 wrote to memory of 2604	1924	0745a91ca11c4c208560564ec24451d7.exe	21

C:\Users\Admin\AppData\Local\Temp\0745a91ca11c4c208560564ec24451d7.exe
"C:\Users\Admin\AppData\Local\Temp\0745a91ca11c4c208560564ec24451d7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 516
  2⤵
  - Program crash
  PID:3588
- C:\Users\Admin\AppData\Local\Temp\0745a91ca11c4c208560564ec24451d7.exe
  "C:\Users\Admin\AppData\Local\Temp\0745a91ca11c4c208560564ec24451d7.exe"
  2⤵
  PID:2604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1924 -ip 1924
1⤵
PID:1936

memory/1924-1-0x00000000021F0000-0x00000000021F2000-memory.dmp

Download

memory/1924-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download