09df1cb53576320f811905d4cd5b93d9d13d4899a7742c9929bcb3cbaef66688

Analysis

max time kernel
157s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 07:26

Target

2d5563d1ee77b0413861b6add770b960.exe
Size

43KB
MD5

2d5563d1ee77b0413861b6add770b960
SHA1

42262f499463bbd6a842db842cd2c6799a8ea3e9
SHA256

09df1cb53576320f811905d4cd5b93d9d13d4899a7742c9929bcb3cbaef66688
SHA512

c3a356bb6445b0e8eec08be344042cf1aa6dccec31f9e6cea87e558eca3c96728a0ecd65d57f928a6340210db1baf81785562a519560b19bb86a865c53995324
SSDEEP

768:8GOM7v3m1AtIeGKPxlD2zidwW1xDR49D1CxaCsQuVcRRYUSUtkqAPcr+Ya3dxr22:8GOMr2GPGgG+TrDR49D1CxaqKqAErP+L

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4476	2288	WerFault.exe	89
2060	2288	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 4476	2288	2d5563d1ee77b0413861b6add770b960.exe	97
PID 2288 wrote to memory of 4476	2288	2d5563d1ee77b0413861b6add770b960.exe	97
PID 2288 wrote to memory of 4476	2288	2d5563d1ee77b0413861b6add770b960.exe	97

C:\Users\Admin\AppData\Local\Temp\2d5563d1ee77b0413861b6add770b960.exe
"C:\Users\Admin\AppData\Local\Temp\2d5563d1ee77b0413861b6add770b960.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 228
  2⤵
  - Program crash
  PID:4476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 228
  2⤵
  - Program crash
  PID:2060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2288 -ip 2288
1⤵
PID:2632

memory/2288-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2288-1-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download