55ed2c2972c152f0126dabb83f64343563e0ded0a38ef7e0acd31f865fe12eee

Analysis

max time kernel
148s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 08:11

Target

3c572caccb52483c21ae10eadd3bd48e.exe
Size

48KB
MD5

3c572caccb52483c21ae10eadd3bd48e
SHA1

a9ae76af710407e6133cb09781acc35db288ad7f
SHA256

55ed2c2972c152f0126dabb83f64343563e0ded0a38ef7e0acd31f865fe12eee
SHA512

0b36128636796a86ae7652b4cab0f6934eb53e72eb94888ae63a28c4861fa3519682397cb604019c4245ccaa970b4fe4fcb77016a656c566102c91a5008d9524
SSDEEP

384:yHiuVkeLtFA7IJyA1ou/1fT44iggJFWhtJI5LKdSCR7Zs2UjAR2B1n5HsWJ:kVzTAIP19fygKKTIpKdSals2OACyS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2348	1376	WerFault.exe	17

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 3532	1376	3c572caccb52483c21ae10eadd3bd48e.exe	51
PID 1376 wrote to memory of 3532	1376	3c572caccb52483c21ae10eadd3bd48e.exe	51
PID 1376 wrote to memory of 3532	1376	3c572caccb52483c21ae10eadd3bd48e.exe	51
PID 1376 wrote to memory of 3532	1376	3c572caccb52483c21ae10eadd3bd48e.exe	51
PID 1376 wrote to memory of 3532	1376	3c572caccb52483c21ae10eadd3bd48e.exe	51
PID 1376 wrote to memory of 3532	1376	3c572caccb52483c21ae10eadd3bd48e.exe	51

C:\Users\Admin\AppData\Local\Temp\3c572caccb52483c21ae10eadd3bd48e.exe
"C:\Users\Admin\AppData\Local\Temp\3c572caccb52483c21ae10eadd3bd48e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 588
  2⤵
  - Program crash
  PID:2348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1376 -ip 1376
1⤵
PID:1368

memory/1376-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1376-2-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1376-1-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1376-11-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1376-10-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3532-4-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/3532-6-0x000000007FFC0000-0x000000007FFC6000-memory.dmp

Filesize
24KB

Download