6275431103aee099fc2f03f69dd5b87f922f1769ed5a59b6301cde3cb9aa6e0d

Analysis

max time kernel
174s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 02:45

Target

2502990cd60006043b95943aa55732b9.exe
Size

117KB
MD5

2502990cd60006043b95943aa55732b9
SHA1

02d7897e72830074f3baf2429ccdcfd5ce2b64e7
SHA256

6275431103aee099fc2f03f69dd5b87f922f1769ed5a59b6301cde3cb9aa6e0d
SHA512

6003412dad6b6588bb94738995b7295cced3e4aa883e9c3da0e25f5cd43cdd97e47d02c8cb3c624dd5e4ebeaf9ed4a286f00371a06d782d2ad62e225ef991f10
SSDEEP

1536:E8J5kj1AH2OOuwoZlF6LSk5C99Hkoq22q/fNnzOyf9CzzPc2xhXFYDSykVsbOI:E8J51H2OLt7IWLkoiIfFzJ2zUefuZ

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3432	2532	WerFault.exe	89
4264	2532	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 3432	2532	2502990cd60006043b95943aa55732b9.exe	96
PID 2532 wrote to memory of 3432	2532	2502990cd60006043b95943aa55732b9.exe	96
PID 2532 wrote to memory of 3432	2532	2502990cd60006043b95943aa55732b9.exe	96

C:\Users\Admin\AppData\Local\Temp\2502990cd60006043b95943aa55732b9.exe
"C:\Users\Admin\AppData\Local\Temp\2502990cd60006043b95943aa55732b9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 224
  2⤵
  - Program crash
  PID:3432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 224
  2⤵
  - Program crash
  PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2532 -ip 2532
1⤵
PID:1644

memory/2532-0-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2532-1-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download