1cdd13d754893d86fda3a07c814fad2e14d32ca513e932150ba6908d017d49b7

Analysis

max time kernel
167s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 00:51

Target
4a3a62c682a402bc35ebc07c95f62fb7.exe
Size 32KB
Sample240108-a7j6rahdbp
SHA256 1cdd13d754893d86fda3a07c814fad2e14d32ca513e932150ba6908d017d49b7
MD5 4a3a62c682a402bc35ebc07c95f62fb7
SHA1 028f8ccd219ed867afb153c9d26f79bbec38029b
SHA512 620b8f688a1dfd04e911a794738474ad045bbea15a766a7c3a45a1d33d7da1262975fd02db5da72d28a11c3b27c4fcfb16888e548f78433e48c0dbd761ba524f
SSDEEP 768:QIk8voGII+z+aZYI4cSN5N4TzMFvXrd4XLBKybiUYtonN2EkzjQf:5k8vohI+zRZYZcSNmzWvXBUEn/oNtkH2
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
892	1488	WerFault.exe	88
4420	1488	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 892	1488	4a3a62c682a402bc35ebc07c95f62fb7.exe	95
PID 1488 wrote to memory of 892	1488	4a3a62c682a402bc35ebc07c95f62fb7.exe	95
PID 1488 wrote to memory of 892	1488	4a3a62c682a402bc35ebc07c95f62fb7.exe	95

C:\Users\Admin\AppData\Local\Temp\4a3a62c682a402bc35ebc07c95f62fb7.exe
"C:\Users\Admin\AppData\Local\Temp\4a3a62c682a402bc35ebc07c95f62fb7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 252
  2⤵
  - Program crash
  PID:892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 252
  2⤵
  - Program crash
  PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1488 -ip 1488
1⤵
PID:4736

memory/1488-0-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/1488-1-0x0000000000400000-0x0000000000418000-memory.dmp

Download