41a9b160c81ee8884cd70a75c4e2a0fa7d5fe301a7c856a7cabf4b96edcd0ff5

Analysis

max time kernel
169s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 20:20

Target

1bba6d45b84aafb96919de32556058f0.exe
Size

11KB
MD5

1bba6d45b84aafb96919de32556058f0
SHA1

8073655e63fc7782d1182a8b3cc31af709a642e9
SHA256

41a9b160c81ee8884cd70a75c4e2a0fa7d5fe301a7c856a7cabf4b96edcd0ff5
SHA512

125259cf41035f15ce14bf4ec57e8cc39c8ad0ff350dba551731b869a1cdab657c4f946b99bdd8e196ce3c00a0d01de20e117daeac55378e75bb2f95f7879017
SSDEEP

192:d0N4ipCtxN1V7LjmvRYn9FNkSQOX/R9LHHBUZBp9W:d0NJULV7Lj+RA9vXJdHBUZBPW

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4536	3932	WerFault.exe	46
3192	3932	WerFault.exe	46

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 4536	3932	1bba6d45b84aafb96919de32556058f0.exe	95
PID 3932 wrote to memory of 4536	3932	1bba6d45b84aafb96919de32556058f0.exe	95
PID 3932 wrote to memory of 4536	3932	1bba6d45b84aafb96919de32556058f0.exe	95

C:\Users\Admin\AppData\Local\Temp\1bba6d45b84aafb96919de32556058f0.exe
"C:\Users\Admin\AppData\Local\Temp\1bba6d45b84aafb96919de32556058f0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 376
  2⤵
  - Program crash
  PID:4536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 376
  2⤵
  - Program crash
  PID:3192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3932 -ip 3932
1⤵
PID:3424

memory/3932-0-0x00000000009A0000-0x00000000009A3000-memory.dmp

Filesize
12KB

Download