ba5c60bb6203a5027a41ccf84d976c432819733abac3862187a17bc47c11ff5e

Analysis

max time kernel
161s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2024 04:42

Target

3fec8d01cb7f91709e6692f504081641.exe
Size

6KB
MD5

3fec8d01cb7f91709e6692f504081641
SHA1

1202ed7cd198d5072a8afc57f079a40e4de6f889
SHA256

ba5c60bb6203a5027a41ccf84d976c432819733abac3862187a17bc47c11ff5e
SHA512

6707e9e2edbe0eb5c691db19cd15507ca0b0fab775857b953d126ad9eca0051e547ed16915ea49a4e9c2c6275e1124575dcab10e65552ecff5a8d1acd4e6fd90
SSDEEP

192:/sUDAeMLRlGYn1FV8rxp9DzgVXheh76YxtiWT9NmyEX6:0UfMzG2POn9o27vPmyEX6

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4564	368	WerFault.exe	88
4660	368	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 4564	368	3fec8d01cb7f91709e6692f504081641.exe	94
PID 368 wrote to memory of 4564	368	3fec8d01cb7f91709e6692f504081641.exe	94
PID 368 wrote to memory of 4564	368	3fec8d01cb7f91709e6692f504081641.exe	94

C:\Users\Admin\AppData\Local\Temp\3fec8d01cb7f91709e6692f504081641.exe
"C:\Users\Admin\AppData\Local\Temp\3fec8d01cb7f91709e6692f504081641.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 368 -s 288
  2⤵
  - Program crash
  PID:4564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 368 -s 288
  2⤵
  - Program crash
  PID:4660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 368 -ip 368
1⤵
PID:4684

memory/368-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/368-1-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download