05734ef9f2a2f5293fb875b8555c59c046d3ff1b6b48b9f2538b02c485cdc02e

Analysis

max time kernel
141s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 01:49

Target

0aa3281e2106676f80a48bd056d3ecdf.exe
Size

593KB
MD5

0aa3281e2106676f80a48bd056d3ecdf
SHA1

32a213643547a74bd220fb2279152a4d6a0f5d49
SHA256

05734ef9f2a2f5293fb875b8555c59c046d3ff1b6b48b9f2538b02c485cdc02e
SHA512

450013d9351bf579b3e215448e176e7d07295405ca6bd8a547e0a02ec968d8b00d5959f258adfbeab1bdf2b476392afd39b7e2dc8f7e569c9c23ed9a1eb85e0c
SSDEEP

12288:WL1dNZVFsbATyU4RvkWh8mW/MM1aWXU0nnn6lqIT:W1jFKt3RvkWhFsltRIT

Score

3^/10

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4536	4192	WerFault.exe	88
2280	1704	WerFault.exe	99
4380	5020	WerFault.exe	98

Suspicious use of UnmapMainImage 3 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 1704	4192	0aa3281e2106676f80a48bd056d3ecdf.exe	99
PID 4192 wrote to memory of 1704	4192	0aa3281e2106676f80a48bd056d3ecdf.exe	99
PID 4192 wrote to memory of 1704	4192	0aa3281e2106676f80a48bd056d3ecdf.exe	99
PID 4192 wrote to memory of 5020	4192	0aa3281e2106676f80a48bd056d3ecdf.exe	98
PID 4192 wrote to memory of 5020	4192	0aa3281e2106676f80a48bd056d3ecdf.exe	98
PID 4192 wrote to memory of 5020	4192	0aa3281e2106676f80a48bd056d3ecdf.exe	98

C:\Users\Admin\AppData\Local\Temp\0aa3281e2106676f80a48bd056d3ecdf.exe
"C:\Users\Admin\AppData\Local\Temp\0aa3281e2106676f80a48bd056d3ecdf.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 572
  2⤵
  - Program crash
  PID:4536
- C:\Users\Admin\AppData\Local\Temp\0aa3281e2106676f80a48bd056d3ecdf.exe
  watch
  2⤵
  - Suspicious use of UnmapMainImage
  PID:5020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 468
    3⤵
    - Program crash
    PID:4380
- C:\Users\Admin\AppData\Local\Temp\0aa3281e2106676f80a48bd056d3ecdf.exe
  start
  2⤵
  - Suspicious use of UnmapMainImage
  PID:1704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 548
    3⤵
    - Program crash
    PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4192 -ip 4192
1⤵
PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1704 -ip 1704
1⤵
PID:1452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5020 -ip 5020
1⤵
PID:3272

memory/1704-3-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1704-5-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4192-0-0x0000000000660000-0x000000000067F000-memory.dmp

Filesize
124KB

Download
memory/4192-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4192-2-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/5020-4-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/5020-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download