a3662b8fdd77511e2b5bb91e2797ff4076555fe3360b88198e078932d131e53d

Analysis

max time kernel
185s
max time network
220s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2024 18:12

Target

4e6bccd94552190533e28058092b989e.exe
Size

1.2MB
MD5

4e6bccd94552190533e28058092b989e
SHA1

b76e030c15bcc91a1336c820db04b76350b7b512
SHA256

a3662b8fdd77511e2b5bb91e2797ff4076555fe3360b88198e078932d131e53d
SHA512

4c65b55963d48d7ddabecd8df36c6541b65857de063ee9407126adee9f7f475c6a10ca812bc9c681750f03290cc393116a7a8c2d4542ffa41315b4832d21e71e
SSDEEP

24576:dHtFjGDfUmf6oIDADj41g3gpzQn65O5C9OkLBlgVIH06iyx:AyDcVJU4qB2IU6iO

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2600 1984 WerFault.exe 4e6bccd94552190533e28058092b989e.exe
2640 1984 WerFault.exe 4e6bccd94552190533e28058092b989e.exe

pid	pid_target	process	target process
2600	1984	WerFault.exe	4e6bccd94552190533e28058092b989e.exe
2640	1984	WerFault.exe	4e6bccd94552190533e28058092b989e.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

4e6bccd94552190533e28058092b989e.exe

description	pid	process	target process
PID 1984 wrote to memory of 2600	1984	4e6bccd94552190533e28058092b989e.exe	WerFault.exe
PID 1984 wrote to memory of 2600	1984	4e6bccd94552190533e28058092b989e.exe	WerFault.exe
PID 1984 wrote to memory of 2600	1984	4e6bccd94552190533e28058092b989e.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4e6bccd94552190533e28058092b989e.exe
"C:\Users\Admin\AppData\Local\Temp\4e6bccd94552190533e28058092b989e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 332
  2⤵
  - Program crash
  PID:2600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 332
  2⤵
  - Program crash
  PID:2640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1984 -ip 1984
1⤵
PID:4988