79a4605d24d32f992d8e144202e980bb6b52bf8c9925b1498a1da59e50ac51f9

Analysis

max time kernel
165s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 08:28

Target

b.exe
Size

25.2MB
MD5

d6527f7d5f5152c3f5fff6786e5c1606
SHA1

e8da82b4a3d2b6bee04236162e5e46e636310ec6
SHA256

79a4605d24d32f992d8e144202e980bb6b52bf8c9925b1498a1da59e50ac51f9
SHA512

2b4eb9e66028d263c52b3da42fa3df256cf49cd7a7ebdf7c75da6a2dedfd2c22cb5f2071345b7016cd742539c74a801cad70c612330be79802fa19f860ea2d5f
SSDEEP

786432:SZYRGnGvovVvAuuglekvAR4vzHcv6lHGH9KdDmvQuLGgJMKV+n9n1vgvVv2jlv1S:Ik79a

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2552	2964	WerFault.exe	91
1700	2964	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2552	2964	b.exe	95
PID 2964 wrote to memory of 2552	2964	b.exe	95
PID 2964 wrote to memory of 2552	2964	b.exe	95

C:\Users\Admin\AppData\Local\Temp\b.exe
"C:\Users\Admin\AppData\Local\Temp\b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 880
  2⤵
  - Program crash
  PID:2552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 880
  2⤵
  - Program crash
  PID:1700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2964 -ip 2964
1⤵
PID:1416

memory/2964-0-0x0000000074A50000-0x0000000075200000-memory.dmp

Filesize
7.7MB

Download
memory/2964-1-0x00000000008E0000-0x000000000220E000-memory.dmp

Filesize
25.2MB

Download
memory/2964-2-0x00000000071E0000-0x0000000007784000-memory.dmp

Filesize
5.6MB

Download
memory/2964-3-0x0000000006CD0000-0x0000000006D62000-memory.dmp

Filesize
584KB

Download
memory/2964-4-0x0000000074A50000-0x0000000075200000-memory.dmp

Filesize
7.7MB

Download
memory/2964-5-0x0000000074A50000-0x0000000075200000-memory.dmp

Filesize
7.7MB

Download