55db08e58738ec61f440c4d99334720d20cd5679a3c709b02c88e94c28951c10

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 11:41

Target
17610de6185f75ba3e15ce3d750c8a86.exe
Size 140KB
Sample231230-ntfs3aabhl
SHA256 55db08e58738ec61f440c4d99334720d20cd5679a3c709b02c88e94c28951c10
MD5 17610de6185f75ba3e15ce3d750c8a86
SHA1 8283be4a127882c45984ddd5ab361a1c171c3ae3
SHA512 d8250c12324b580dfe0f8ad13d559a2d62b32cf5577fda9d41147767ff3a086305e382347deddc0a806e6f95317c3522d9e1231e1da93183d59e94471af46fef
SSDEEP 1536:yioQGnE4u0LkT2biRCR4TdFGntt1mQ8nU+YD3q7VoagHA:Pp7okTJRC5ttOnU3a7Voa
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3368	844	WerFault.exe	87
3076	844	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 3368	844	17610de6185f75ba3e15ce3d750c8a86.exe	90
PID 844 wrote to memory of 3368	844	17610de6185f75ba3e15ce3d750c8a86.exe	90
PID 844 wrote to memory of 3368	844	17610de6185f75ba3e15ce3d750c8a86.exe	90

C:\Users\Admin\AppData\Local\Temp\17610de6185f75ba3e15ce3d750c8a86.exe
"C:\Users\Admin\AppData\Local\Temp\17610de6185f75ba3e15ce3d750c8a86.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 304
  2⤵
  - Program crash
  PID:3368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 304
  2⤵
  - Program crash
  PID:3076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 844 -ip 844
1⤵
PID:2772

memory/844-0-0x0000000000400000-0x000000000089E000-memory.dmp

Download