12724d370dd5fa219ef423b9190d369567dc68bd3a522b64e63e7008b53e6268

Analysis

max time kernel
218s
max time network
243s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 19:58

Target

0271a636f22282e5aad31a67688a358d.exe
Size

553KB
MD5

0271a636f22282e5aad31a67688a358d
SHA1

4b5cf68eb02972e23910dd4bbb9e089e5f83de6b
SHA256

12724d370dd5fa219ef423b9190d369567dc68bd3a522b64e63e7008b53e6268
SHA512

0702f0d217517d673d91456535ced706659706204d2d66f35e25bf63d80db6dd9fcaf9c2e719174e94692f36ee3f8cc0c59a11295ccae3f357b5acd5876325f8
SSDEEP

12288:7PQI6s5gpXPMsYb5nq1TwQYBL7Ciby3yXhc:0I2XPMsY5q1NYBL7CiW3yO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3692	4964	WerFault.exe	84

Suspicious use of UnmapMainImage 3 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 4996	4964	0271a636f22282e5aad31a67688a358d.exe	101
PID 4964 wrote to memory of 4996	4964	0271a636f22282e5aad31a67688a358d.exe	101
PID 4964 wrote to memory of 4996	4964	0271a636f22282e5aad31a67688a358d.exe	101
PID 4964 wrote to memory of 3192	4964	0271a636f22282e5aad31a67688a358d.exe	102
PID 4964 wrote to memory of 3192	4964	0271a636f22282e5aad31a67688a358d.exe	102
PID 4964 wrote to memory of 3192	4964	0271a636f22282e5aad31a67688a358d.exe	102

C:\Users\Admin\AppData\Local\Temp\0271a636f22282e5aad31a67688a358d.exe
"C:\Users\Admin\AppData\Local\Temp\0271a636f22282e5aad31a67688a358d.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 512
  2⤵
  - Program crash
  PID:3692
- C:\Users\Admin\AppData\Local\Temp\0271a636f22282e5aad31a67688a358d.exe
  start
  2⤵
  - Suspicious use of UnmapMainImage
  PID:4996
- C:\Users\Admin\AppData\Local\Temp\0271a636f22282e5aad31a67688a358d.exe
  watch
  2⤵
  - Suspicious use of UnmapMainImage
  PID:3192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4964 -ip 4964
1⤵
PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3192 -ip 3192
1⤵
PID:4672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4996 -ip 4996
1⤵
PID:3892

memory/3192-5-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/3192-7-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/4964-0-0x000000007FE30000-0x000000007FE4F000-memory.dmp

Filesize
124KB

Download
memory/4964-1-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/4964-2-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/4964-3-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/4996-4-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/4996-6-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download