617b5501632e12798d9d4fd4caa9bb223f75cca0dcdf4f885cf41f4687b2adfb

Analysis

max time kernel
167s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 01:16

Target

09cb9c2538ba615e4ec8c9160220383f.exe
Size

88KB
MD5

09cb9c2538ba615e4ec8c9160220383f
SHA1

9e40810c42d77fec6c5e0b3ae627e94838955a39
SHA256

617b5501632e12798d9d4fd4caa9bb223f75cca0dcdf4f885cf41f4687b2adfb
SHA512

6f8227cad838da14bb3fd2963394cc6a727ce8ea7198df46291608d12bac2ead845d653cc17ac1fc5419812a8e1f0b392cd1ed9cf440137b20af0b9b3abc444d
SSDEEP

1536:MrSXuNgsn/yaOYP5w/Fv99MIKQjNQIz5+Lq6vD5p1TsYhLPej1YT1RBfvZFx80Nt:MrSXu+xYP5wdfMIxjNr5+XD/1AYh+S1p

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3988	3164	WerFault.exe	87
3592	3164	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 3592	3164	09cb9c2538ba615e4ec8c9160220383f.exe	94
PID 3164 wrote to memory of 3592	3164	09cb9c2538ba615e4ec8c9160220383f.exe	94
PID 3164 wrote to memory of 3592	3164	09cb9c2538ba615e4ec8c9160220383f.exe	94

C:\Users\Admin\AppData\Local\Temp\09cb9c2538ba615e4ec8c9160220383f.exe
"C:\Users\Admin\AppData\Local\Temp\09cb9c2538ba615e4ec8c9160220383f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 224
  2⤵
  - Program crash
  PID:3988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 224
  2⤵
  - Program crash
  PID:3592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3164 -ip 3164
1⤵
PID:2852