6999f6ee47b734222933293db302861cc9949c8cff87eb59a1ebf99b8af8df51

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 01:07

Target

22903d51860406029889f4e431cbbe29.exe
Size

65KB
MD5

22903d51860406029889f4e431cbbe29
SHA1

c6092a9bfb97d44e80c783d5efc3265c9b5f4d26
SHA256

6999f6ee47b734222933293db302861cc9949c8cff87eb59a1ebf99b8af8df51
SHA512

d99c7d3f1c36d4a026a3b33827e567c376109bc1d397763b36eaf0fbe6ab5178249eb54d5427e0ca2fcb4f1cb325195909899ec34b78cfb22a7168696c7bc798
SSDEEP

768:apV2VcdAF/egBcz5XyDO/SSrpy8mXRA2iUpcQimdLNjHAqGrXNZqa+Yw1bLCIg:avzcKNXB/JaWApJMqiXN3wNL

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system\35885345.fon	22903d51860406029889f4e431cbbe29.exe

Program crash 1 IoCs

pid	pid_target	Process
3196	4940	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 4940	1428	22903d51860406029889f4e431cbbe29.exe	19
PID 1428 wrote to memory of 4940	1428	22903d51860406029889f4e431cbbe29.exe	19
PID 1428 wrote to memory of 4940	1428	22903d51860406029889f4e431cbbe29.exe	19

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4940 -ip 4940
1⤵
PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 224
1⤵
- Program crash
PID:3196

C:\Users\Admin\AppData\Local\Temp\22903d51860406029889f4e431cbbe29.exe
C:\Users\Admin\AppData\Local\Temp\22903d51860406029889f4e431cbbe29.exe
1⤵
- Drops file in Windows directory
PID:4940

C:\Users\Admin\AppData\Local\Temp\22903d51860406029889f4e431cbbe29.exe
"C:\Users\Admin\AppData\Local\Temp\22903d51860406029889f4e431cbbe29.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1428

memory/1428-1-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1428-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4940-3-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download