e1e4ecd94004911ba8e88661ae184be57964555d3e190d4680a22987d0aa61a5

Analysis

max time kernel
137s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2024 06:44

Target

484b7586f8b12783849d4d46b95003e7.exe
Size

23KB
MD5

484b7586f8b12783849d4d46b95003e7
SHA1

85ab0af7b2afa07016dcfe9725a044180070b8b4
SHA256

e1e4ecd94004911ba8e88661ae184be57964555d3e190d4680a22987d0aa61a5
SHA512

066335071c8f5de936d7cfc3011ba1c3f81893f045c783775e2d1f95cd057887bbcab76c2558151ac702f4ee30c74e019abdb3ce1129bc006c87310ef179a105
SSDEEP

384:j1mV1IHfQxShwZ0zhBQ56vwhvs/Lu+BNkGqcuBl5LPgTkBTH6JxE6ntb+esn01:j1mV1IHfAFZ0dNuKNkGqNGoH6XnN+e40

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1392	1824	WerFault.exe	87
1660	1824	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 1392	1824	484b7586f8b12783849d4d46b95003e7.exe	96
PID 1824 wrote to memory of 1392	1824	484b7586f8b12783849d4d46b95003e7.exe	96
PID 1824 wrote to memory of 1392	1824	484b7586f8b12783849d4d46b95003e7.exe	96

C:\Users\Admin\AppData\Local\Temp\484b7586f8b12783849d4d46b95003e7.exe
"C:\Users\Admin\AppData\Local\Temp\484b7586f8b12783849d4d46b95003e7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 232
  2⤵
  - Program crash
  PID:1392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 232
  2⤵
  - Program crash
  PID:1660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1824 -ip 1824
1⤵
PID:880

memory/1824-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1824-1-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1824-2-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1824-4-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download