7a1468c2385fe7ee9f36df22ff81fdcf6288f8283c59df35cd89833233cd7600

Analysis

max time kernel
138s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 07:06

Target

11b76131f8120b2d1c93fa9e8c7f17cf.exe
Size

144KB
MD5

11b76131f8120b2d1c93fa9e8c7f17cf
SHA1

518fb0a02e1716a067fde0ded653501af90937dd
SHA256

7a1468c2385fe7ee9f36df22ff81fdcf6288f8283c59df35cd89833233cd7600
SHA512

62f89e827f706f23c391aad0be54c3643a3e7c93bc4c7be9204ef20143a3d5c55066dbe8d1d52eea5d3adb717c662f3d3cf3d251de9355d0a7723061609520b7
SSDEEP

3072:mDalazliTWbU7l+MdMl5taWoDc/vGH/K1jVWXIIPEB:mXGWb+lVd+ug/a/K15KII

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3224	2344	WerFault.exe	89
1508	2344	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 3224	2344	11b76131f8120b2d1c93fa9e8c7f17cf.exe	95
PID 2344 wrote to memory of 3224	2344	11b76131f8120b2d1c93fa9e8c7f17cf.exe	95
PID 2344 wrote to memory of 3224	2344	11b76131f8120b2d1c93fa9e8c7f17cf.exe	95

C:\Users\Admin\AppData\Local\Temp\11b76131f8120b2d1c93fa9e8c7f17cf.exe
"C:\Users\Admin\AppData\Local\Temp\11b76131f8120b2d1c93fa9e8c7f17cf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 224
  2⤵
  - Program crash
  PID:3224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 224
  2⤵
  - Program crash
  PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2344 -ip 2344
1⤵
PID:4872

memory/2344-0-0x0000000000400000-0x000000000044F23E-memory.dmp

Filesize
316KB

Download
memory/2344-1-0x0000000000400000-0x000000000044F23E-memory.dmp

Filesize
316KB

Download