91e4d63701494bfb30acf705ed064520e44b7cb31c4d52f9f324ff810b810ab9

Analysis

max time kernel
170s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 09:42

Target

14ca2ad35a61d32040684a11bbd193e7.exe
Size

429KB
MD5

14ca2ad35a61d32040684a11bbd193e7
SHA1

6ecb441e2295627f62aa75164ce366499f846750
SHA256

91e4d63701494bfb30acf705ed064520e44b7cb31c4d52f9f324ff810b810ab9
SHA512

51afca1f6dad69bc5f09fdde02ad7783361c8c0ccd6d12c1ad8cd92144599760748c214cde9834d05f45ee92698eacd96b5754fba1c824f006bcc02cc539d6f6
SSDEEP

6144:AYbWW2WDmyUUqK5EhEMDMg48Td50WKtNvGRNxw8QUYK:AhWjmyUUqK5j030TyNC8Q

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1140	3776	WerFault.exe	89
3340	3776	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 1140	3776	14ca2ad35a61d32040684a11bbd193e7.exe	94
PID 3776 wrote to memory of 1140	3776	14ca2ad35a61d32040684a11bbd193e7.exe	94
PID 3776 wrote to memory of 1140	3776	14ca2ad35a61d32040684a11bbd193e7.exe	94

C:\Users\Admin\AppData\Local\Temp\14ca2ad35a61d32040684a11bbd193e7.exe
"C:\Users\Admin\AppData\Local\Temp\14ca2ad35a61d32040684a11bbd193e7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 332
  2⤵
  - Program crash
  PID:1140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 332
  2⤵
  - Program crash
  PID:3340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 3776 -ip 3776
1⤵
PID:2948

memory/3776-0-0x0000000000930000-0x00000000009A0000-memory.dmp

Filesize
448KB

Download