4c4b0d0b5d89c472ca45d7d9ca5b2047e291f989660723c477f1443d39297a3e

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 05:22

Target
0fe81d4f8de665d348edb7e4e92ae097.exe
Size 221KB
Sample231230-f22fqsffb7
SHA256 4c4b0d0b5d89c472ca45d7d9ca5b2047e291f989660723c477f1443d39297a3e
MD5 0fe81d4f8de665d348edb7e4e92ae097
SHA1 ecc775101e19d1371797c0861a6fde3a8586ea67
SHA512 3ecf43562f0f52d826cd20eba334163b1630c7ae8219620e2a0c63a080525e0c2f0e86075b1d1b10589ffd67696972b08c119481c87e3a3537719afc334ee32a
SSDEEP 6144:UuUZdwb+lox+VrO6JxheyVTdpnHQZJi+mGSnL:UDwb+l4+VjJxfBdpUJivnL
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5052	3172	WerFault.exe	88

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3172	0fe81d4f8de665d348edb7e4e92ae097.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 3160	3172	0fe81d4f8de665d348edb7e4e92ae097.exe	90
PID 3172 wrote to memory of 3160	3172	0fe81d4f8de665d348edb7e4e92ae097.exe	90
PID 3172 wrote to memory of 3160	3172	0fe81d4f8de665d348edb7e4e92ae097.exe	90

C:\Users\Admin\AppData\Local\Temp\0fe81d4f8de665d348edb7e4e92ae097.exe
"C:\Users\Admin\AppData\Local\Temp\0fe81d4f8de665d348edb7e4e92ae097.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Users\Admin\AppData\Local\Temp\0fe81d4f8de665d348edb7e4e92ae097.exe
  "C:\Users\Admin\AppData\Local\Temp\0fe81d4f8de665d348edb7e4e92ae097.exe"
  2⤵
  PID:3160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 324
  2⤵
  - Program crash
  PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3172 -ip 3172
1⤵
PID:2416

memory/3172-0-0x0000000000070000-0x0000000000076000-memory.dmp

Download

memory/3172-1-0x0000000002ED0000-0x0000000002ED2000-memory.dmp

Download