1379c32e7df1c4ec17cd060fe51205028b20959251d4a7b2ca810006bb4f6904

Analysis

max time kernel
128s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 07:18

Target

2d134c49704bc59fe9e1f54dddace8e1.exe
Size

566KB
MD5

2d134c49704bc59fe9e1f54dddace8e1
SHA1

1ced33006475570b16b64fccfc15514f1e2079ef
SHA256

1379c32e7df1c4ec17cd060fe51205028b20959251d4a7b2ca810006bb4f6904
SHA512

42c11dcc75638cfbc9550bd165538bad811cfdac28b4533423d5064800aabbd0c4d14c030725ec532acb70a86850dcce2ad5ce88dff6ab6a26e8c4a4704ddcbb
SSDEEP

6144:k3rJjM4pnuvONUttdod+sR/HF2GDKal7pebQkfRORVxSAhPulqYMgDQffEwI:kbGqHUvdod+sBHF2GDLlNeb3++AqQ1I

Score

3^/10

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3172	3988	WerFault.exe	86
1540	1304	WerFault.exe	97
2044	4020	WerFault.exe	98

Suspicious use of UnmapMainImage 3 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 1304	3988	2d134c49704bc59fe9e1f54dddace8e1.exe	97
PID 3988 wrote to memory of 1304	3988	2d134c49704bc59fe9e1f54dddace8e1.exe	97
PID 3988 wrote to memory of 1304	3988	2d134c49704bc59fe9e1f54dddace8e1.exe	97
PID 3988 wrote to memory of 4020	3988	2d134c49704bc59fe9e1f54dddace8e1.exe	98
PID 3988 wrote to memory of 4020	3988	2d134c49704bc59fe9e1f54dddace8e1.exe	98
PID 3988 wrote to memory of 4020	3988	2d134c49704bc59fe9e1f54dddace8e1.exe	98

C:\Users\Admin\AppData\Local\Temp\2d134c49704bc59fe9e1f54dddace8e1.exe
"C:\Users\Admin\AppData\Local\Temp\2d134c49704bc59fe9e1f54dddace8e1.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 600
  2⤵
  - Program crash
  PID:3172
- C:\Users\Admin\AppData\Local\Temp\2d134c49704bc59fe9e1f54dddace8e1.exe
  start
  2⤵
  - Suspicious use of UnmapMainImage
  PID:1304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 564
    3⤵
    - Program crash
    PID:1540
- C:\Users\Admin\AppData\Local\Temp\2d134c49704bc59fe9e1f54dddace8e1.exe
  watch
  2⤵
  - Suspicious use of UnmapMainImage
  PID:4020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 564
    3⤵
    - Program crash
    PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3988 -ip 3988
1⤵
PID:2720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1304 -ip 1304
1⤵
PID:884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4020 -ip 4020
1⤵
PID:2976

memory/1304-3-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1304-5-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/3988-0-0x00000000021F0000-0x000000000220F000-memory.dmp

Filesize
124KB

Download
memory/3988-1-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/3988-2-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/4020-4-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/4020-6-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download