7114d33d76354f3a0c6bb376c682a353c466d0aabb0a3a8e1766ac1b71a21a5d

Analysis

max time kernel
200s
max time network
214s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 02:10

Target
240500ef8281124a2a34957aec437b51.exe
Size 132KB
Sample231231-cl189acfhp
SHA256 7114d33d76354f3a0c6bb376c682a353c466d0aabb0a3a8e1766ac1b71a21a5d
MD5 240500ef8281124a2a34957aec437b51
SHA1 04b78232151e8e0688c7f7af7fafe7c6181a6ddd
SHA512 163fbd15259c2b67bb66501af8347e2af96dee8c88456db39e5a79fef27f1556d36cfb4d78c2a03635a659934440a0ad77bd74091199d95f7baa989f1a6e03ff
SSDEEP 1536:vI17aKyOZ4p4zvBfURL/Sp8xYsMajY411a7Ea6mmDn+SW8JJlLDDeEb3cckXf6Ki:g1r++voTpYsI41s91gs8JL7/EexkgSd
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1420	232	WerFault.exe	87
5068	232	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 1420	232	240500ef8281124a2a34957aec437b51.exe	94
PID 232 wrote to memory of 1420	232	240500ef8281124a2a34957aec437b51.exe	94
PID 232 wrote to memory of 1420	232	240500ef8281124a2a34957aec437b51.exe	94

C:\Users\Admin\AppData\Local\Temp\240500ef8281124a2a34957aec437b51.exe
"C:\Users\Admin\AppData\Local\Temp\240500ef8281124a2a34957aec437b51.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 228
  2⤵
  - Program crash
  PID:1420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 228
  2⤵
  - Program crash
  PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 232 -ip 232
1⤵
PID:988

memory/232-0-0x0000000000400000-0x000000000043C000-memory.dmp

Download