e66efbe405be933bb8a27d4b4beb8632bf395cb810ebd2f56b915edbee619a37

Analysis

max time kernel
151s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/01/2024, 14:38

Target

1eba93412d726c87aa094a3c44d9268a.exe
Size

176KB
MD5

1eba93412d726c87aa094a3c44d9268a
SHA1

f3ff7dd4573fdbcb2825a7fcad934b5c5235b431
SHA256

e66efbe405be933bb8a27d4b4beb8632bf395cb810ebd2f56b915edbee619a37
SHA512

d8e8b325b5869c75356de1e012daf440e8ffbf23b038a40cf97fdf84ce12a18854d720c4a2aa2a0074ef06b2d1c5015460588670127c1bf1419e2b23b71d0246
SSDEEP

3072:upMlNPPG3GRfo8RKjhzGBqOYcYZlDd8FdymUvuFWVAsiLYmFsL5+/aGw8R2KGU:upYNOWRg8UtGbY/iFdLUvuFuBoRGW2

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1932	752	WerFault.exe	17
2432	752	WerFault.exe	17

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 1932	752	1eba93412d726c87aa094a3c44d9268a.exe	93
PID 752 wrote to memory of 1932	752	1eba93412d726c87aa094a3c44d9268a.exe	93
PID 752 wrote to memory of 1932	752	1eba93412d726c87aa094a3c44d9268a.exe	93

C:\Users\Admin\AppData\Local\Temp\1eba93412d726c87aa094a3c44d9268a.exe
"C:\Users\Admin\AppData\Local\Temp\1eba93412d726c87aa094a3c44d9268a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 408
  2⤵
  - Program crash
  PID:1932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 408
  2⤵
  - Program crash
  PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 752 -ip 752
1⤵
PID:4028