ed2456d48c11fd6da833872afd07b5e35e7ac6de93d37425364278c809dc63a7

Analysis

max time kernel
166s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2024 10:30

Target

3c9e644c6dea739777cea4d9b6e93296.exe
Size

92KB
MD5

3c9e644c6dea739777cea4d9b6e93296
SHA1

2411b1734d25a780f6fc384e1f7dac858c323af1
SHA256

ed2456d48c11fd6da833872afd07b5e35e7ac6de93d37425364278c809dc63a7
SHA512

fdb5cb5a07b26bc57558613bf99da2936e830aabde3c99c3a7115ff6266448139bb2fedaaa4ab582b3654b4127369e785b6417a5445b0da7d133e15397dd81f9
SSDEEP

1536:CnBSeMBl7hTg/mkdc3fGwTGoOA2nP8cJIgQaZeJbw7TTwTg9/VN8DYnKtaVQZJ/1:CnBqhkZdw4A9cJdft/V+DR0qZC0

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3988 1476 WerFault.exe 3c9e644c6dea739777cea4d9b6e93296.exe
4764 1476 WerFault.exe 3c9e644c6dea739777cea4d9b6e93296.exe

pid	pid_target	process	target process
3988	1476	WerFault.exe	3c9e644c6dea739777cea4d9b6e93296.exe
4764	1476	WerFault.exe	3c9e644c6dea739777cea4d9b6e93296.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

3c9e644c6dea739777cea4d9b6e93296.exe

description	pid	process	target process
PID 1476 wrote to memory of 3988	1476	3c9e644c6dea739777cea4d9b6e93296.exe	WerFault.exe
PID 1476 wrote to memory of 3988	1476	3c9e644c6dea739777cea4d9b6e93296.exe	WerFault.exe
PID 1476 wrote to memory of 3988	1476	3c9e644c6dea739777cea4d9b6e93296.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3c9e644c6dea739777cea4d9b6e93296.exe
"C:\Users\Admin\AppData\Local\Temp\3c9e644c6dea739777cea4d9b6e93296.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 576
2⤵
- Program crash
PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 576
2⤵
- Program crash
PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1476 -ip 1476
1⤵
PID:384