7832da15a56a1714e8cba2549e8354acac481b5dcfa2587260d6efeccd6155ad

Analysis

max time kernel
142s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 13:33

Target

382b0662ec44973a274460070c9752a5.exe
Size

179KB
MD5

382b0662ec44973a274460070c9752a5
SHA1

48409fdec9127c0258dd5f44c178fdf99be315dc
SHA256

7832da15a56a1714e8cba2549e8354acac481b5dcfa2587260d6efeccd6155ad
SHA512

e97cc3179ebeb3f064c58b5eeeaf2fc472b53cc4afffc55bce101f69b6706aea21c6f8a1b27e4ed8b5fbed9303df85cb875a85a7e4377b17d54b448e893cd348
SSDEEP

3072:7f+KBK1tcs7/vx3D/3/kwRw+0k+IsESdkf7FMVeLun/ThXH2zvanZ4OY:j+vnjvx3D3Xh9SkzSeLun/ThXWzvB7

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1296	3336	WerFault.exe	15
1496	3336	WerFault.exe	15

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 1296	3336	382b0662ec44973a274460070c9752a5.exe	93
PID 3336 wrote to memory of 1296	3336	382b0662ec44973a274460070c9752a5.exe	93
PID 3336 wrote to memory of 1296	3336	382b0662ec44973a274460070c9752a5.exe	93

C:\Users\Admin\AppData\Local\Temp\382b0662ec44973a274460070c9752a5.exe
"C:\Users\Admin\AppData\Local\Temp\382b0662ec44973a274460070c9752a5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 612
  2⤵
  - Program crash
  PID:1296
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 612
  2⤵
  - Program crash
  PID:1496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3336 -ip 3336
1⤵
PID:4944

memory/3336-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download