b1b4adb57471b463700ab48f81cd2550270fac73e0c1a95366fdc4380d15a659

Analysis

max time kernel
147s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
06-01-2024 10:16

Target

458ad2463c8a61f37ce0c256d5d824e0.exe
Size

447KB
MD5

458ad2463c8a61f37ce0c256d5d824e0
SHA1

3d9e3331f558962d5fbbab68f8a9dcca0b31bb6f
SHA256

b1b4adb57471b463700ab48f81cd2550270fac73e0c1a95366fdc4380d15a659
SHA512

690cc999cf47d7d4020c3087c261b67a1468ed38392cf7b63ff41ed18a93d1a36a2f685c6f44c4121e61a2f49430ac019b7aff45a3a4a8a8da89339ce40b3a17
SSDEEP

12288:efiUDGoIgDSiJc8uFxhSGeFSkVKNA9iMVLF1qHYfpRY80HiN433FLNNNNNNNNNNb:5QjJcJiGegkVIGLF1q4fpRY80HiN433h

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4476	1436	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 2364	1436	458ad2463c8a61f37ce0c256d5d824e0.exe	19
PID 1436 wrote to memory of 2364	1436	458ad2463c8a61f37ce0c256d5d824e0.exe	19
PID 1436 wrote to memory of 2364	1436	458ad2463c8a61f37ce0c256d5d824e0.exe	19

C:\Users\Admin\AppData\Local\Temp\458ad2463c8a61f37ce0c256d5d824e0.exe
"C:\Users\Admin\AppData\Local\Temp\458ad2463c8a61f37ce0c256d5d824e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Users\Admin\AppData\Local\Temp\458ad2463c8a61f37ce0c256d5d824e0.exe
  "C:\Users\Admin\AppData\Local\Temp\458ad2463c8a61f37ce0c256d5d824e0.exe"
  2⤵
  PID:2364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 364
  2⤵
  - Program crash
  PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 1436 -ip 1436
1⤵
PID:4812

memory/1436-2-0x0000000000B90000-0x0000000000B92000-memory.dmp

Filesize
8KB

Download
memory/1436-1-0x00000000000A0000-0x00000000001A0000-memory.dmp

Filesize
1024KB

Download