73f52e38ae7c9e66f702c34cbfa5d1db00852274ebfec2efdbd0d71b19a04ecd

Analysis

max time kernel
147s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 04:58

Target

29161ec3f250f63d659414f8e32b0b89.exe
Size

157KB
MD5

29161ec3f250f63d659414f8e32b0b89
SHA1

35abe61fefe668d329b73a68a65d1098db5c9168
SHA256

73f52e38ae7c9e66f702c34cbfa5d1db00852274ebfec2efdbd0d71b19a04ecd
SHA512

312d2c319fffffe9c3ee888f7c485e23a443a383f4e94fa675557b1da24bc5d840fdb43eb691c8eef4fed4ba8004b1e5a9e58be83a2456a6ab5c5e1a606f0c15
SSDEEP

3072:j6CIAhi93Cxa9UbCoQNLZqy4V+H0Y9zW3IbaMvxvG1RvXcfpPPurRI:eCThi9yIisNP4TY9KiHvxvG3Ed

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1300	1992	WerFault.exe	21
692	1992	WerFault.exe	21

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1300	1992	29161ec3f250f63d659414f8e32b0b89.exe	92
PID 1992 wrote to memory of 1300	1992	29161ec3f250f63d659414f8e32b0b89.exe	92
PID 1992 wrote to memory of 1300	1992	29161ec3f250f63d659414f8e32b0b89.exe	92

C:\Users\Admin\AppData\Local\Temp\29161ec3f250f63d659414f8e32b0b89.exe
"C:\Users\Admin\AppData\Local\Temp\29161ec3f250f63d659414f8e32b0b89.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 364
  2⤵
  - Program crash
  PID:1300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 364
  2⤵
  - Program crash
  PID:692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1992 -ip 1992
1⤵
PID:1428