08ecde2579ce0db26c35175ad6ce07f0f6e859ee583685a576e3a583f185a82f

Analysis

max time kernel
154s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2024 15:49

Target

41459c656df029d96586f193d01a4b0e.exe
Size

3.4MB
MD5

41459c656df029d96586f193d01a4b0e
SHA1

5457ee83d78368acc12bd306c4524c3da934f200
SHA256

08ecde2579ce0db26c35175ad6ce07f0f6e859ee583685a576e3a583f185a82f
SHA512

9b3dd65292eb4ac70c496ea9a953d85242a942068263daf22c37bd11840768a8656c752935634ba709861f84b539547356c45e6b4f856861e76bb32fa2f2563b
SSDEEP

49152:Ss1rGENwNLZigay118YovFbZIKTeWojCTDSLuM3P3mweVqZs2oJIi5cXVbLaaC2:SshNuLZigV118YAhEREVvan

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1832	4256	WerFault.exe	36
5092	4256	WerFault.exe	36

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 1832	4256	41459c656df029d96586f193d01a4b0e.exe	94
PID 4256 wrote to memory of 1832	4256	41459c656df029d96586f193d01a4b0e.exe	94
PID 4256 wrote to memory of 1832	4256	41459c656df029d96586f193d01a4b0e.exe	94

C:\Users\Admin\AppData\Local\Temp\41459c656df029d96586f193d01a4b0e.exe
"C:\Users\Admin\AppData\Local\Temp\41459c656df029d96586f193d01a4b0e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 288
  2⤵
  - Program crash
  PID:1832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 288
  2⤵
  - Program crash
  PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 4256 -ip 4256
1⤵
PID:1624

memory/4256-0-0x0000000000400000-0x00000000007F4000-memory.dmp

Filesize
4.0MB

Download
memory/4256-1-0x0000000000400000-0x00000000007F4000-memory.dmp

Filesize
4.0MB

Download