4c50504d7492978cab7621994c0a8cbec20a6b09a5fc64d02c71c236c4d5ddd8

Analysis

max time kernel
152s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2024, 06:43

Target

4305888cae17517b7f3edbcbac3a81b6.exe
Size

25KB
MD5

4305888cae17517b7f3edbcbac3a81b6
SHA1

a70fa55e4cd31f3aaf76cf12abf85dcd4e4af8c0
SHA256

4c50504d7492978cab7621994c0a8cbec20a6b09a5fc64d02c71c236c4d5ddd8
SHA512

ac99c90b0f8a3788c2100f77a37a8e3d7b3551a6ff86b0e4796ca370d21e2417d31b3b9c49b23f20a1d8031a741e1cbcfa0f581b00bfe55cc3bcf3a09d40349b
SSDEEP

384:agJY1ez54kzWfjtxLv8BID9YuHNZgcd2RtmGSQuHhrgibG:+i54kKBxLvVBtZgw2RUGSQ6BbbG

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3704	4864	WerFault.exe	89
220	4864	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 3704	4864	4305888cae17517b7f3edbcbac3a81b6.exe	96
PID 4864 wrote to memory of 3704	4864	4305888cae17517b7f3edbcbac3a81b6.exe	96
PID 4864 wrote to memory of 3704	4864	4305888cae17517b7f3edbcbac3a81b6.exe	96

C:\Users\Admin\AppData\Local\Temp\4305888cae17517b7f3edbcbac3a81b6.exe
"C:\Users\Admin\AppData\Local\Temp\4305888cae17517b7f3edbcbac3a81b6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 248
  2⤵
  - Program crash
  PID:3704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 248
  2⤵
  - Program crash
  PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4864 -ip 4864
1⤵
PID:468