050d2dd1b332f3f22ab3b00a3f144aad964b963bec942c20926b4892a8428e60

Analysis

max time kernel
138s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
06-01-2024 21:16

Target

47320f9582fbd915b4714a843a0cde92.exe
Size

589KB
MD5

47320f9582fbd915b4714a843a0cde92
SHA1

3abbafbd84af7a824bd34ac2ba67e2e791b40704
SHA256

050d2dd1b332f3f22ab3b00a3f144aad964b963bec942c20926b4892a8428e60
SHA512

176d235766401a4f7a3639d5b70d118e80b46445f5ef43322685965386d415ba3d6bbd1b6263aaa4b80a264dfc470fe37b76c3400fe3c2936b6cf8b636205c5f
SSDEEP

12288:USn0JQtsP8qtoSZoRB7SFkTg9UODo7NKpvdauOH+9FKD9iH:U46Eqru9Tg91hfe

Score

3^/10

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4700	3160	WerFault.exe	68
3096	3796	WerFault.exe	95
1140	2508	WerFault.exe	96

Suspicious use of UnmapMainImage 3 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 3796	3160	47320f9582fbd915b4714a843a0cde92.exe	95
PID 3160 wrote to memory of 3796	3160	47320f9582fbd915b4714a843a0cde92.exe	95
PID 3160 wrote to memory of 3796	3160	47320f9582fbd915b4714a843a0cde92.exe	95
PID 3160 wrote to memory of 2508	3160	47320f9582fbd915b4714a843a0cde92.exe	96
PID 3160 wrote to memory of 2508	3160	47320f9582fbd915b4714a843a0cde92.exe	96
PID 3160 wrote to memory of 2508	3160	47320f9582fbd915b4714a843a0cde92.exe	96

C:\Users\Admin\AppData\Local\Temp\47320f9582fbd915b4714a843a0cde92.exe
"C:\Users\Admin\AppData\Local\Temp\47320f9582fbd915b4714a843a0cde92.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 516
  2⤵
  - Program crash
  PID:4700
- C:\Users\Admin\AppData\Local\Temp\47320f9582fbd915b4714a843a0cde92.exe
  start
  2⤵
  - Suspicious use of UnmapMainImage
  PID:3796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 488
    3⤵
    - Program crash
    PID:3096
- C:\Users\Admin\AppData\Local\Temp\47320f9582fbd915b4714a843a0cde92.exe
  watch
  2⤵
  - Suspicious use of UnmapMainImage
  PID:2508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 408
    3⤵
    - Program crash
    PID:1140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3160 -ip 3160
1⤵
PID:3628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3796 -ip 3796
1⤵
PID:4240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2508 -ip 2508
1⤵
PID:1640

memory/2508-4-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2508-6-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/3160-0-0x000000007FE30000-0x000000007FE4F000-memory.dmp

Filesize
124KB

Download
memory/3160-1-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/3160-2-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/3796-3-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/3796-5-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download