28a0a4797e0743bddfd9bebe5ebe5221325d6142a9d8a194e87e63ae1c4b7715

Analysis

max time kernel
152s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 14:19

Target

50c8d5288ffd6cffc6ad27cf14abec7f.exe
Size

425KB
MD5

50c8d5288ffd6cffc6ad27cf14abec7f
SHA1

aeed091036abf43ba67452b53b9a7f95d9e34b25
SHA256

28a0a4797e0743bddfd9bebe5ebe5221325d6142a9d8a194e87e63ae1c4b7715
SHA512

b0d2dc1cf0171673655831616308fb6713651931911c22e7d8fe25136ff8ee0e55d909aee04ad56f20468eb1544aaa1bc30577a7d4884c2e36495666c80f270f
SSDEEP

12288:Vsi1SFwfIu0NMqXV/zWsyr/JaXRdXW9HxugKsUi:VR1Sc70OqRzWsyrGRY9Ardi

Score

3^/10

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4904	5068	WerFault.exe	89
1948	5068	WerFault.exe	89
4280	5068	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 4904	5068	50c8d5288ffd6cffc6ad27cf14abec7f.exe	97
PID 5068 wrote to memory of 4904	5068	50c8d5288ffd6cffc6ad27cf14abec7f.exe	97
PID 5068 wrote to memory of 4904	5068	50c8d5288ffd6cffc6ad27cf14abec7f.exe	97

C:\Users\Admin\AppData\Local\Temp\50c8d5288ffd6cffc6ad27cf14abec7f.exe
"C:\Users\Admin\AppData\Local\Temp\50c8d5288ffd6cffc6ad27cf14abec7f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 568
  2⤵
  - Program crash
  PID:4904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 568
  2⤵
  - Program crash
  PID:1948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 568
  2⤵
  - Program crash
  PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5068 -ip 5068
1⤵
PID:1500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5068 -ip 5068
1⤵
PID:4048

memory/5068-0-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/5068-1-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/5068-4-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/5068-3-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/5068-5-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/5068-6-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/5068-8-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/5068-7-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/5068-9-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/5068-10-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/5068-11-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/5068-12-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/5068-13-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/5068-14-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/5068-15-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/5068-16-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download