8de53ad535a8f853f6789bd2b9eac5e5348cb1321139f5e5006c471de86b3ff1

Analysis

max time kernel
143s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 10:24

Target

15d4c8aeaca7cba61d921d4fce0c4ad9.exe
Size

33KB
MD5

15d4c8aeaca7cba61d921d4fce0c4ad9
SHA1

a7f828b03e5b0e48aca1b7a0ff14061aaf1c8407
SHA256

8de53ad535a8f853f6789bd2b9eac5e5348cb1321139f5e5006c471de86b3ff1
SHA512

ef75d537a43bb32f4ec91d2aa8ea73e045f8e5c36f1467f7ec8468bf546ba9a2c48ed5cfd7db4e032e8e89b26dcf9769cccdaa8091e0d856d115b7e0d23da2bd
SSDEEP

768:kKfVGejflJgCAbklPkDnqX1Itplxx+aHOFNbikjyMrcPkhRTN:NfV5jfluCAbklP0NbjxR6QMrKkPJ

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
828	1928	WerFault.exe	88
796	1928	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 828	1928	15d4c8aeaca7cba61d921d4fce0c4ad9.exe	94
PID 1928 wrote to memory of 828	1928	15d4c8aeaca7cba61d921d4fce0c4ad9.exe	94
PID 1928 wrote to memory of 828	1928	15d4c8aeaca7cba61d921d4fce0c4ad9.exe	94

C:\Users\Admin\AppData\Local\Temp\15d4c8aeaca7cba61d921d4fce0c4ad9.exe
"C:\Users\Admin\AppData\Local\Temp\15d4c8aeaca7cba61d921d4fce0c4ad9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 224
  2⤵
  - Program crash
  PID:828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 224
  2⤵
  - Program crash
  PID:796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1928 -ip 1928
1⤵
PID:2392

memory/1928-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1928-1-0x00000000001C0000-0x00000000001C8000-memory.dmp

Filesize
32KB

Download
memory/1928-2-0x00000000006D0000-0x0000000000870000-memory.dmp

Filesize
1.6MB

Download
memory/1928-3-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download