d8ac2789b130251d735b1562eb2da7a56e05dee3741e1357e0522452c3a66c73

Analysis

max time kernel
145s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 19:31

Target

01cc961be72ba6ab7d43a57d59b4da00.exe
Size

287KB
MD5

01cc961be72ba6ab7d43a57d59b4da00
SHA1

77a4525d015b0b8079d5cea64bb20e240dc55e5f
SHA256

d8ac2789b130251d735b1562eb2da7a56e05dee3741e1357e0522452c3a66c73
SHA512

906b0db126221f54ba3f9e4650c770009d70aa76a5e2f87ea3651a640b59672ec6c8de9b6090a554553f61199aceabab4609686f44d36ec5d6a7107f631e804c
SSDEEP

6144:n1N65aYY3bAevPcl0OHYXA8Rnm4KQ/45gBcI2Yz6Po9o5QTVm:n1qal3bAevPcyEYQcKQ/LBcI2YzPoST

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4700	5064	WerFault.exe	29
4008	5064	WerFault.exe	29

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 4700	5064	01cc961be72ba6ab7d43a57d59b4da00.exe	95
PID 5064 wrote to memory of 4700	5064	01cc961be72ba6ab7d43a57d59b4da00.exe	95
PID 5064 wrote to memory of 4700	5064	01cc961be72ba6ab7d43a57d59b4da00.exe	95

C:\Users\Admin\AppData\Local\Temp\01cc961be72ba6ab7d43a57d59b4da00.exe
"C:\Users\Admin\AppData\Local\Temp\01cc961be72ba6ab7d43a57d59b4da00.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 224
  2⤵
  - Program crash
  PID:4700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 224
  2⤵
  - Program crash
  PID:4008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 5064 -ip 5064
1⤵
PID:3312

memory/5064-0-0x0000000000400000-0x0000000000548000-memory.dmp

Filesize
1.3MB

Download
memory/5064-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/5064-2-0x0000000000400000-0x0000000000548000-memory.dmp

Filesize
1.3MB

Download
memory/5064-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download