1f6e1db2d24ff58fffb5f31d5c2a82da121775747529236c02a2a910270a8032

Analysis

max time kernel
206s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 01:37

Target

3f9253d826a5758335343c3f8d6bb043.exe
Size

15KB
MD5

3f9253d826a5758335343c3f8d6bb043
SHA1

3607e84f3c33ee62016528ebe953d01a5a3759a6
SHA256

1f6e1db2d24ff58fffb5f31d5c2a82da121775747529236c02a2a910270a8032
SHA512

291feb2949f460af74b5bb5162315243d9233fbc1d0a5b514b8d7f854fd2e568053ea57250c3b4da41079e9bd6a1e62678888feb4489a8494347ae85f84fe706
SSDEEP

384:4pTaiAUvJTJ5vhv508SA8whOWQNQVhx1GM/+IWc+DBJ5FL3/:WadUvJNy8b8wMWQSxklIiJHb

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1436	4804	WerFault.exe	51
2320	4804	WerFault.exe	51

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 1436	4804	3f9253d826a5758335343c3f8d6bb043.exe	91
PID 4804 wrote to memory of 1436	4804	3f9253d826a5758335343c3f8d6bb043.exe	91
PID 4804 wrote to memory of 1436	4804	3f9253d826a5758335343c3f8d6bb043.exe	91

C:\Users\Admin\AppData\Local\Temp\3f9253d826a5758335343c3f8d6bb043.exe
"C:\Users\Admin\AppData\Local\Temp\3f9253d826a5758335343c3f8d6bb043.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 224
  2⤵
  - Program crash
  PID:1436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 224
  2⤵
  - Program crash
  PID:2320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4804 -ip 4804
1⤵
PID:224

memory/4804-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4804-1-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download