864ab1a3252b5629040b7b9b2efda4c8172180158d11bb6704fca332fd2650a9

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 12:45

Target

369c5bf7de0116ea4efb94241f5156e9.exe
Size

86KB
MD5

369c5bf7de0116ea4efb94241f5156e9
SHA1

2fa216c6953134ead71b3272eb3f9a4e662d0a00
SHA256

864ab1a3252b5629040b7b9b2efda4c8172180158d11bb6704fca332fd2650a9
SHA512

de952f29f99fa50bf1566c2a06a85782bb286ed45b864585e04000a4fcafd1edcde40fae4b5d834c70ab276529f9c7f73f1f49eafa519308a02a9716426d9546
SSDEEP

1536:1bqTQxBrGVnH5y6YDKvYJKvNr14eqNGxO4Rqu2tQhVe:eUdSnHQ6nvYox9qNGxO4oae

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5016	3116	WerFault.exe
4324	4864	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 3116	4864	369c5bf7de0116ea4efb94241f5156e9.exe	26
PID 4864 wrote to memory of 3116	4864	369c5bf7de0116ea4efb94241f5156e9.exe	26
PID 4864 wrote to memory of 3116	4864	369c5bf7de0116ea4efb94241f5156e9.exe	26
PID 4864 wrote to memory of 3116	4864	369c5bf7de0116ea4efb94241f5156e9.exe	26

C:\Users\Admin\AppData\Local\Temp\369c5bf7de0116ea4efb94241f5156e9.exe
"C:\Users\Admin\AppData\Local\Temp\369c5bf7de0116ea4efb94241f5156e9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 472
  2⤵
  - Program crash
  PID:4324
- C:\Users\Admin\AppData\Local\Temp\369c5bf7de0116ea4efb94241f5156e9.exe
  C:\Users\Admin\AppData\Local\Temp\369c5bf7de0116ea4efb94241f5156e9.exe
  2⤵
  PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3116 -ip 3116
1⤵
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 80
1⤵
- Program crash
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4864 -ip 4864
1⤵
PID:1256

memory/4864-0-0x0000000050010000-0x000000005002F000-memory.dmp

Filesize
124KB

Download