38d15f782634dd60cb0289a3ab99e4f8f118fde4efddf96bfb21df05572b95c0

Analysis

max time kernel
137s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 03:21

Target

2632861cbaaa9a3f1070d85e24ae9b84.exe
Size

120KB
MD5

2632861cbaaa9a3f1070d85e24ae9b84
SHA1

977771909fe9ffa00e1aa9ff8916e45dd6931034
SHA256

38d15f782634dd60cb0289a3ab99e4f8f118fde4efddf96bfb21df05572b95c0
SHA512

9b2678efcaaaa7be9f11e1a40771527ab992c5d3ceff58fd070343aca0989420442cc14462fafd3083d42114d704420bffba7b7a92a38aa1ef4cd61da1e1ddee
SSDEEP

1536:ZlHpPpo03z0oHwLVLrvXe3b0IscbC9EzCJu79+EaNaBQhgj7xTOc:Zlo0D0s4ZrfeBVzNJM7+j7cc

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1704	2608	WerFault.exe	87
1592	2608	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 1704	2608	2632861cbaaa9a3f1070d85e24ae9b84.exe	95
PID 2608 wrote to memory of 1704	2608	2632861cbaaa9a3f1070d85e24ae9b84.exe	95
PID 2608 wrote to memory of 1704	2608	2632861cbaaa9a3f1070d85e24ae9b84.exe	95

C:\Users\Admin\AppData\Local\Temp\2632861cbaaa9a3f1070d85e24ae9b84.exe
"C:\Users\Admin\AppData\Local\Temp\2632861cbaaa9a3f1070d85e24ae9b84.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 476
  2⤵
  - Program crash
  PID:1704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 476
  2⤵
  - Program crash
  PID:1592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 2608 -ip 2608
1⤵
PID:1520