73eebc72b6a280e6aae44d99efa7eca6ce621f420e50af7d49248c01ab68247f

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 19:02

Target

0126ea90433f3cffb1ce9ba4fa3e2e40.exe
Size

416KB
MD5

0126ea90433f3cffb1ce9ba4fa3e2e40
SHA1

6cf4af2ad62307c09aeff28a15082dabf2521081
SHA256

73eebc72b6a280e6aae44d99efa7eca6ce621f420e50af7d49248c01ab68247f
SHA512

67cddf07c11f684bcb91a0aa6002c0da034528b41145df81b907f4779f24f87bed1d73b5edda6064e7fc5c05f7a4ff4ef1e6281433f8402b79f478c61cfde679
SSDEEP

6144:bkqbvaFGC3aDn8dlHSKaEc/34svsJMiS0cdUeLpDebYSuyOB:bbvqVaDn8dl1c/uJMfLLsbduf

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4920	1228	WerFault.exe	89
4820	1228	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 4920	1228	0126ea90433f3cffb1ce9ba4fa3e2e40.exe	95
PID 1228 wrote to memory of 4920	1228	0126ea90433f3cffb1ce9ba4fa3e2e40.exe	95
PID 1228 wrote to memory of 4920	1228	0126ea90433f3cffb1ce9ba4fa3e2e40.exe	95

C:\Users\Admin\AppData\Local\Temp\0126ea90433f3cffb1ce9ba4fa3e2e40.exe
"C:\Users\Admin\AppData\Local\Temp\0126ea90433f3cffb1ce9ba4fa3e2e40.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 272
  2⤵
  - Program crash
  PID:4920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 272
  2⤵
  - Program crash
  PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1228 -ip 1228
1⤵
PID:3996