ef01b04a82e39311f276fcfec11bdc62fe6fb8f86a41610a5a8d15503a7d01fa

Analysis

max time kernel
144s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 00:26

Target

08849310a345d900e1a41d44565bb53b.exe
Size

24KB
MD5

08849310a345d900e1a41d44565bb53b
SHA1

bb06997ece2bee4878f38e2b1988d696531dd1f2
SHA256

ef01b04a82e39311f276fcfec11bdc62fe6fb8f86a41610a5a8d15503a7d01fa
SHA512

134687afb2b50007efbb333581995eaf2ff6be47784d6cf0d19c9a793233d41e50aa8dd4d6deebf87df0fe4538c664598502f1673dcb236ae7f06bc3ebe2ff98
SSDEEP

384:sekWoyxjzmUzU6Gc2Cv4Az8MMsNGZ9T2CEPqs5wGBm1z9/:PVz7sc2C98MZ0f2CEPc/

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2164	4596	WerFault.exe	14
2304	1972	WerFault.exe	101

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 1972	4596	08849310a345d900e1a41d44565bb53b.exe	101
PID 4596 wrote to memory of 1972	4596	08849310a345d900e1a41d44565bb53b.exe	101
PID 4596 wrote to memory of 1972	4596	08849310a345d900e1a41d44565bb53b.exe	101

C:\Users\Admin\AppData\Local\Temp\08849310a345d900e1a41d44565bb53b.exe
"C:\Users\Admin\AppData\Local\Temp\08849310a345d900e1a41d44565bb53b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Users\Admin\AppData\Local\Temp\08849310a345d900e1a41d44565bb53b.exe
  "C:\Users\Admin\AppData\Local\Temp\08849310a345d900e1a41d44565bb53b.exe"
  2⤵
  PID:1972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 12
    3⤵
    - Program crash
    PID:2304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 300
  2⤵
  - Program crash
  PID:2164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4596 -ip 4596
1⤵
PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1972 -ip 1972
1⤵
PID:3524

memory/4596-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download