8377f14adcb98d8af8e70d74642afc09b6e72cf56aa55d734aafadc41596a317

Analysis

max time kernel
153s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 13:50

Target

38afda4effa4cb8a29e8e5b8af91b1e5.exe
Size

10KB
MD5

38afda4effa4cb8a29e8e5b8af91b1e5
SHA1

cd2611d911c37dc68525bc36b24fb69e6cea6f34
SHA256

8377f14adcb98d8af8e70d74642afc09b6e72cf56aa55d734aafadc41596a317
SHA512

83422717402beb076d0177db43e0b99a9da863584a88fc6afdfe80f4d3872976497c4b295a5f81f649ddb0c249a8a4de34ea6af292e0099c6f3b3ddb980e519e
SSDEEP

192:Mf/I9svuInld09g/WigJY+o1BZ+RN8danXfHNavyNh+MaZx1ZQC68IYBKvF:8/I9y3nzYSsi+o1L+uqNai4xT

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1556	1944	WerFault.exe	88
1412	1944	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1556	1944	38afda4effa4cb8a29e8e5b8af91b1e5.exe	96
PID 1944 wrote to memory of 1556	1944	38afda4effa4cb8a29e8e5b8af91b1e5.exe	96
PID 1944 wrote to memory of 1556	1944	38afda4effa4cb8a29e8e5b8af91b1e5.exe	96

C:\Users\Admin\AppData\Local\Temp\38afda4effa4cb8a29e8e5b8af91b1e5.exe
"C:\Users\Admin\AppData\Local\Temp\38afda4effa4cb8a29e8e5b8af91b1e5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 436
  2⤵
  - Program crash
  PID:1556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 436
  2⤵
  - Program crash
  PID:1412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1944 -ip 1944
1⤵
PID:1608

memory/1944-0-0x0000000000400000-0x000000000090A000-memory.dmp

Filesize
5.0MB

Download
memory/1944-1-0x0000000000400000-0x000000000090A000-memory.dmp

Filesize
5.0MB

Download
memory/1944-2-0x0000000002650000-0x0000000002652000-memory.dmp

Filesize
8KB

Download
memory/1944-3-0x0000000000400000-0x000000000090A000-memory.dmp

Filesize
5.0MB

Download