06f2f4f1263b0067221dbee97ffcf4f5b8d7dcd558f307b357c72818f7c7724d

Analysis

max time kernel
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 22:15

Target

1e2b14c8748d00dbc42db4370390fd59.exe
Size

637KB
MD5

1e2b14c8748d00dbc42db4370390fd59
SHA1

8207a81f0c11ab182adc997acfc4874f284e6348
SHA256

06f2f4f1263b0067221dbee97ffcf4f5b8d7dcd558f307b357c72818f7c7724d
SHA512

ea551a0420e922a7564db20946011c9bfe9b64e415faca8ca444d6f5d78459d5aaeeb58eb908bdbff70b1371e9df7b166574f7bed2d4af98236bf9ee20d71db6
SSDEEP

12288:aHZKLiNomy1J8m9QnitNx5CIn0g9Or88Q1iTSiI+bbU46F:aCiNA1J8m2ivZ0EOY8Q1iTSiI+bbUj

Score

3^/10

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4012	2276	WerFault.exe	86
4108	3264	WerFault.exe	94
4688	1408	WerFault.exe	95

Suspicious use of UnmapMainImage 3 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 3264	2276	1e2b14c8748d00dbc42db4370390fd59.exe	94
PID 2276 wrote to memory of 3264	2276	1e2b14c8748d00dbc42db4370390fd59.exe	94
PID 2276 wrote to memory of 3264	2276	1e2b14c8748d00dbc42db4370390fd59.exe	94
PID 2276 wrote to memory of 1408	2276	1e2b14c8748d00dbc42db4370390fd59.exe	95
PID 2276 wrote to memory of 1408	2276	1e2b14c8748d00dbc42db4370390fd59.exe	95
PID 2276 wrote to memory of 1408	2276	1e2b14c8748d00dbc42db4370390fd59.exe	95

C:\Users\Admin\AppData\Local\Temp\1e2b14c8748d00dbc42db4370390fd59.exe
"C:\Users\Admin\AppData\Local\Temp\1e2b14c8748d00dbc42db4370390fd59.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 520
  2⤵
  - Program crash
  PID:4012
- C:\Users\Admin\AppData\Local\Temp\1e2b14c8748d00dbc42db4370390fd59.exe
  start
  2⤵
  - Suspicious use of UnmapMainImage
  PID:3264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 500
    3⤵
    - Program crash
    PID:4108
- C:\Users\Admin\AppData\Local\Temp\1e2b14c8748d00dbc42db4370390fd59.exe
  watch
  2⤵
  - Suspicious use of UnmapMainImage
  PID:1408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 500
    3⤵
    - Program crash
    PID:4688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2276 -ip 2276
1⤵
PID:3740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3264 -ip 3264
1⤵
PID:932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1408 -ip 1408
1⤵
PID:4376

memory/1408-4-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/1408-6-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2276-0-0x0000000000600000-0x000000000061F000-memory.dmp

Filesize
124KB

Download
memory/2276-1-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2276-2-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/3264-3-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/3264-5-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download