4b047eee9ee680841f286716409235872693ae3a5ca54acfb3280ef3307ab08c

Analysis

max time kernel
163s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 04:39

Target

2884aa0007d1e06216565dcd15466970.exe
Size

112KB
MD5

2884aa0007d1e06216565dcd15466970
SHA1

848a311901b797782a23f8c6df766bf35827b331
SHA256

4b047eee9ee680841f286716409235872693ae3a5ca54acfb3280ef3307ab08c
SHA512

8da4222fed58609a29fc4ad4da30c2c1f61d23e1b68ecbdb1a0744f6b4cb9a86520b4e53f0daa48cb199b5013819e6db147ed46d255525f633ae3df97c4899d1
SSDEEP

1536:r2JW6/4BEzByeEoHhA8Lh7I0FlJlmBjs+WymZvVoejRGjOisGuXJ2mR2HV:ro1/nzUjcTaOlJUXWy0vaSbBXJ2m

Score

3^/10

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4412	1640	WerFault.exe	87
3988	1640	WerFault.exe	87
1760	1640	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 4412	1640	2884aa0007d1e06216565dcd15466970.exe	95
PID 1640 wrote to memory of 4412	1640	2884aa0007d1e06216565dcd15466970.exe	95
PID 1640 wrote to memory of 4412	1640	2884aa0007d1e06216565dcd15466970.exe	95

C:\Users\Admin\AppData\Local\Temp\2884aa0007d1e06216565dcd15466970.exe
"C:\Users\Admin\AppData\Local\Temp\2884aa0007d1e06216565dcd15466970.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 224
  2⤵
  - Program crash
  PID:4412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 220
  2⤵
  - Program crash
  PID:3988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 224
  2⤵
  - Program crash
  PID:1760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1640 -ip 1640
1⤵
PID:732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1640 -ip 1640
1⤵
PID:432

memory/1640-0-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download