7114d33d76354f3a0c6bb376c682a353c466d0aabb0a3a8e1766ac1b71a21a5d

Analysis

max time kernel
200s
max time network
214s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 02:10

Target

240500ef8281124a2a34957aec437b51.exe
Size

132KB
MD5

240500ef8281124a2a34957aec437b51
SHA1

04b78232151e8e0688c7f7af7fafe7c6181a6ddd
SHA256

7114d33d76354f3a0c6bb376c682a353c466d0aabb0a3a8e1766ac1b71a21a5d
SHA512

163fbd15259c2b67bb66501af8347e2af96dee8c88456db39e5a79fef27f1556d36cfb4d78c2a03635a659934440a0ad77bd74091199d95f7baa989f1a6e03ff
SSDEEP

1536:vI17aKyOZ4p4zvBfURL/Sp8xYsMajY411a7Ea6mmDn+SW8JJlLDDeEb3cckXf6Ki:g1r++voTpYsI41s91gs8JL7/EexkgSd

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1420	232	WerFault.exe	87
5068	232	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 1420	232	240500ef8281124a2a34957aec437b51.exe	94
PID 232 wrote to memory of 1420	232	240500ef8281124a2a34957aec437b51.exe	94
PID 232 wrote to memory of 1420	232	240500ef8281124a2a34957aec437b51.exe	94

C:\Users\Admin\AppData\Local\Temp\240500ef8281124a2a34957aec437b51.exe
"C:\Users\Admin\AppData\Local\Temp\240500ef8281124a2a34957aec437b51.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 228
  2⤵
  - Program crash
  PID:1420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 228
  2⤵
  - Program crash
  PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 232 -ip 232
1⤵
PID:988

memory/232-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download