11d0bc229140431236344800a77d952b7d8fa992feeb95d4a0405dbf14d62bae

Analysis

max time kernel
132s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 20:32

Target

0338537dbbb87ac7fc80424fccc0fd99.exe
Size

13KB
MD5

0338537dbbb87ac7fc80424fccc0fd99
SHA1

7ac7c275e77f6160ee62af4b665999a5a9eac2fe
SHA256

11d0bc229140431236344800a77d952b7d8fa992feeb95d4a0405dbf14d62bae
SHA512

cbc7279ed5cf658058cec7d3f7438e3b7d75e2fba3a54c05df9e98d1f92f9d7022552a62d5bab999975ae60c96bc4795b18f764228fec3a86d480b3a5b4b0ef5
SSDEEP

384:37QeVaMye/enPsgRA8DEWiCReJ4gYb3P0wlU1SBe:seVaMyeWvDE6RC/wP0wO1SBe

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2504	4524	WerFault.exe	87
2640	4524	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 2504	4524	0338537dbbb87ac7fc80424fccc0fd99.exe	93
PID 4524 wrote to memory of 2504	4524	0338537dbbb87ac7fc80424fccc0fd99.exe	93
PID 4524 wrote to memory of 2504	4524	0338537dbbb87ac7fc80424fccc0fd99.exe	93

C:\Users\Admin\AppData\Local\Temp\0338537dbbb87ac7fc80424fccc0fd99.exe
"C:\Users\Admin\AppData\Local\Temp\0338537dbbb87ac7fc80424fccc0fd99.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 224
  2⤵
  - Program crash
  PID:2504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 224
  2⤵
  - Program crash
  PID:2640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4524 -ip 4524
1⤵
PID:2408