dec52c86f4b3039daf01f1a360840fc11efef37eb69e746592e62fced0226c53

Analysis

max time kernel
166s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 05:02

Target

293273e78a337fd7c0cea93613db0c0b.exe
Size

422KB
MD5

293273e78a337fd7c0cea93613db0c0b
SHA1

b56451c0088dff35d664c792288c804e31c826b8
SHA256

dec52c86f4b3039daf01f1a360840fc11efef37eb69e746592e62fced0226c53
SHA512

7e3c0c86fc45982a617b07adbbd29bbde41179fce02dba631b95e549c9bfe3d87bc79341571746a8113ba682f564ba595f8703ecc38f01bf51aa8928b6eaf023
SSDEEP

6144:ykB1INZdWaFzaE7mDGg7Y4+MFyBPys80G5sEOi9Ri9na5UVx3:ykBgdW/E7mDGg8xMkBp80GiZa5UVh

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1340	2384	WerFault.exe	89
1272	2384	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 1340	2384	293273e78a337fd7c0cea93613db0c0b.exe	97
PID 2384 wrote to memory of 1340	2384	293273e78a337fd7c0cea93613db0c0b.exe	97
PID 2384 wrote to memory of 1340	2384	293273e78a337fd7c0cea93613db0c0b.exe	97

C:\Users\Admin\AppData\Local\Temp\293273e78a337fd7c0cea93613db0c0b.exe
"C:\Users\Admin\AppData\Local\Temp\293273e78a337fd7c0cea93613db0c0b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 332
  2⤵
  - Program crash
  PID:1340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 332
  2⤵
  - Program crash
  PID:1272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2384 -ip 2384
1⤵
PID:3460

memory/2384-0-0x0000000000C60000-0x0000000000CCE000-memory.dmp

Filesize
440KB

Download