47d2b01f5ee0730737e31424546748b5df95355f562063ffcfad399fb16aef92

Analysis

max time kernel
143s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 05:25

Target

0ff52c09060e6af9551ec45644c3118e.exe
Size

3.6MB
MD5

0ff52c09060e6af9551ec45644c3118e
SHA1

1437f3dabfadc956ba02e04d7dbee9759130b57f
SHA256

47d2b01f5ee0730737e31424546748b5df95355f562063ffcfad399fb16aef92
SHA512

4dfc877b6efb11531ae8265fce535bfe806dcf1634ee437ecae3d85c3ba2f2b77cdc10d64f1ac64f160c8d3b9f560c538954427512cafa12ce0ad57679ed54be
SSDEEP

98304:yy0C0q/m8MNRNQQGlIIBDodL+jPPzsOUz9c2jCVx6L:D0TGpodL+jPPUhc2jCHG

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4864	4184	WerFault.exe	88
2068	4184	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 4864	4184	0ff52c09060e6af9551ec45644c3118e.exe	96
PID 4184 wrote to memory of 4864	4184	0ff52c09060e6af9551ec45644c3118e.exe	96
PID 4184 wrote to memory of 4864	4184	0ff52c09060e6af9551ec45644c3118e.exe	96

C:\Users\Admin\AppData\Local\Temp\0ff52c09060e6af9551ec45644c3118e.exe
"C:\Users\Admin\AppData\Local\Temp\0ff52c09060e6af9551ec45644c3118e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 228
  2⤵
  - Program crash
  PID:4864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 228
  2⤵
  - Program crash
  PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 4184 -ip 4184
1⤵
PID:3904