c58febfad4e9b75406cbcab05f02756088c8000b8491a9e543f81e20966df5a5

Analysis

max time kernel
197s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 13:16

Target

19b09db608f2b8f8b3b7d2d998f5b702.exe
Size

482KB
MD5

19b09db608f2b8f8b3b7d2d998f5b702
SHA1

6d6060b0bbc179444d73258009ec763fc6f6b913
SHA256

c58febfad4e9b75406cbcab05f02756088c8000b8491a9e543f81e20966df5a5
SHA512

a98960b4bf551bf2293ff603668806a5c0632af9e6adc93c3af895f179ced228c0c40c079ef8d2eadaa14ad27a09bc4178fbdefc63a6ff268fbed678e8fb3b03
SSDEEP

6144:03BgalfSwK9VG0ZzxM+nFjhOG6V4bpuMsAcFlL8omeSt/PC1F7OQB8673Snpl:cBgalfSJYGxMKBUMLcF96mF7MUYn

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5000	4456	WerFault.exe	86
536	4456	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 5000	4456	19b09db608f2b8f8b3b7d2d998f5b702.exe	93
PID 4456 wrote to memory of 5000	4456	19b09db608f2b8f8b3b7d2d998f5b702.exe	93
PID 4456 wrote to memory of 5000	4456	19b09db608f2b8f8b3b7d2d998f5b702.exe	93

C:\Users\Admin\AppData\Local\Temp\19b09db608f2b8f8b3b7d2d998f5b702.exe
"C:\Users\Admin\AppData\Local\Temp\19b09db608f2b8f8b3b7d2d998f5b702.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 484
  2⤵
  - Program crash
  PID:5000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 484
  2⤵
  - Program crash
  PID:536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4456 -ip 4456
1⤵
PID:4568

memory/4456-0-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/4456-1-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4456-6-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4456-7-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download