131f551bd9f4613a4cbe274d19f0798b58898470c1df1b3d414eb105eab345eb

Analysis

max time kernel
117s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 05:58

Target

2aec3c515bf7f627060db5886adfb2c4.exe
Size

589KB
MD5

2aec3c515bf7f627060db5886adfb2c4
SHA1

d554eadd9264c399a3b245effc4d22f7296e55cb
SHA256

131f551bd9f4613a4cbe274d19f0798b58898470c1df1b3d414eb105eab345eb
SHA512

e2137ae5c7e750a4533f803436670e872aa51ea42c9353ffec673e54e822e1ba19a5d64a078735d1c587714eeb586b1e2518ef08d80bba0d0b502dcb374eb47a
SSDEEP

6144:AqGFCwWI7D+inb/5/lG3yPKZmla/q1u2DiG3WCqryzdlAbcn197:AU6vb/NlG3yPpcyu2+02+Ziu

Score

3^/10

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4188	4680	WerFault.exe	78
4804	3296	WerFault.exe	95
1832	4276	WerFault.exe	94

Suspicious use of UnmapMainImage 3 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 4276	4680	2aec3c515bf7f627060db5886adfb2c4.exe	94
PID 4680 wrote to memory of 4276	4680	2aec3c515bf7f627060db5886adfb2c4.exe	94
PID 4680 wrote to memory of 4276	4680	2aec3c515bf7f627060db5886adfb2c4.exe	94
PID 4680 wrote to memory of 3296	4680	2aec3c515bf7f627060db5886adfb2c4.exe	95
PID 4680 wrote to memory of 3296	4680	2aec3c515bf7f627060db5886adfb2c4.exe	95
PID 4680 wrote to memory of 3296	4680	2aec3c515bf7f627060db5886adfb2c4.exe	95

C:\Users\Admin\AppData\Local\Temp\2aec3c515bf7f627060db5886adfb2c4.exe
"C:\Users\Admin\AppData\Local\Temp\2aec3c515bf7f627060db5886adfb2c4.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 632
  2⤵
  - Program crash
  PID:4188
- C:\Users\Admin\AppData\Local\Temp\2aec3c515bf7f627060db5886adfb2c4.exe
  start
  2⤵
  - Suspicious use of UnmapMainImage
  PID:4276
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 480
    3⤵
    - Program crash
    PID:1832
- C:\Users\Admin\AppData\Local\Temp\2aec3c515bf7f627060db5886adfb2c4.exe
  watch
  2⤵
  - Suspicious use of UnmapMainImage
  PID:3296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 600
    3⤵
    - Program crash
    PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4680 -ip 4680
1⤵
PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3296 -ip 3296
1⤵
PID:208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4276 -ip 4276
1⤵
PID:2680

memory/3296-3-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/3296-6-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/4276-4-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/4276-5-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/4680-0-0x000000007FE30000-0x000000007FE4F000-memory.dmp

Filesize
124KB

Download
memory/4680-1-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/4680-2-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download