8fc0fa7eebb1017436a326b914208903491a47451ab84a952e5fddd7a110d9f6

Analysis

max time kernel
154s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 10:44

Target

164b0c7b4aa704c0195d697c2c96b2f7.exe
Size

722KB
MD5

164b0c7b4aa704c0195d697c2c96b2f7
SHA1

3588c96a323871b8a7f070dabdb9bac6068ba804
SHA256

8fc0fa7eebb1017436a326b914208903491a47451ab84a952e5fddd7a110d9f6
SHA512

caef900bc5b507a6c0d6f3ca10537c1c9872fd4daa79e700fa7bb39dd3aa8cbaf8ac1aabefeefc61d2157d4f3aa2b5eb52bf67035e2eb51eb3bd9e244e623f17
SSDEEP

12288:a5OxgcIVe0XfojfeokI+FloVPDkfdjfEYpda123MMXm1j1WWoPeeyORz4P:aIxAPoTvAFlGkjfC1237WZAPe5+

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1936	5100	WerFault.exe	90
3424	5100	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 1936	5100	164b0c7b4aa704c0195d697c2c96b2f7.exe	97
PID 5100 wrote to memory of 1936	5100	164b0c7b4aa704c0195d697c2c96b2f7.exe	97
PID 5100 wrote to memory of 1936	5100	164b0c7b4aa704c0195d697c2c96b2f7.exe	97

C:\Users\Admin\AppData\Local\Temp\164b0c7b4aa704c0195d697c2c96b2f7.exe
"C:\Users\Admin\AppData\Local\Temp\164b0c7b4aa704c0195d697c2c96b2f7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 488
  2⤵
  - Program crash
  PID:1936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 488
  2⤵
  - Program crash
  PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5100 -ip 5100
1⤵
PID:4784

memory/5100-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5100-1-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download