5be3f7d6931a82d6623648f8d98fd51050dbaa210aad6bc187b8aa394c3dfcb5

Analysis

max time kernel
137s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08-01-2024 11:35

Target

4b5366bac7957b97cac2a3efeef2804e.exe
Size

452KB
MD5

4b5366bac7957b97cac2a3efeef2804e
SHA1

4474d531bb155e1842b1ae6f8c471cf8b6c1ea1c
SHA256

5be3f7d6931a82d6623648f8d98fd51050dbaa210aad6bc187b8aa394c3dfcb5
SHA512

9c74dc56a4d764787df7447fbc9b54c63e72183621222fdcb29015322b51ca64e6cda1dfe93d39056b7ab9bc376c041e941ee0fb26cb607e246276db9b9d51b1
SSDEEP

12288:de6KRlnwiSm+xHSD71QKK1MieKbSUsJfclZwn+hRl1U6y0Qhf:d3KpSKD71E1MieKDZg+hjyFhf

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4804	4584	WerFault.exe	89
4384	4584	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 4804	4584	4b5366bac7957b97cac2a3efeef2804e.exe	94
PID 4584 wrote to memory of 4804	4584	4b5366bac7957b97cac2a3efeef2804e.exe	94
PID 4584 wrote to memory of 4804	4584	4b5366bac7957b97cac2a3efeef2804e.exe	94

C:\Users\Admin\AppData\Local\Temp\4b5366bac7957b97cac2a3efeef2804e.exe
"C:\Users\Admin\AppData\Local\Temp\4b5366bac7957b97cac2a3efeef2804e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 384
  2⤵
  - Program crash
  PID:4804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 384
  2⤵
  - Program crash
  PID:4384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4584 -ip 4584
1⤵
PID:3684