8d3abe0465ed767ca69829b4dedf840cf58163c60af52f3016b061b4e4c923fc

Analysis

max time kernel
153s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2024 17:57

Target

5139b2695e9bef33594a3926bd3e22ce.exe
Size

422KB
MD5

5139b2695e9bef33594a3926bd3e22ce
SHA1

ff69af4444f4e7ac2ac4f3dfbbb2e6d82e79f4bd
SHA256

8d3abe0465ed767ca69829b4dedf840cf58163c60af52f3016b061b4e4c923fc
SHA512

25ee500a68bbbbd23d589a59e94bd096309092ba7933c50c172cce0dfdf48d3794da675903f39768ad77bd0d034472935c292c757dc0925ae5a2f3580d6c8f53
SSDEEP

6144:ykB1INZdWaFzaE7mDGg7Y4+MFyBPys80G5sEOi9Ri9na5UVx3:ykBgdW/E7mDGg8xMkBp80GiZa5UVh

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4264	4416	WerFault.exe	89
4136	4416	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 4264	4416	5139b2695e9bef33594a3926bd3e22ce.exe	97
PID 4416 wrote to memory of 4264	4416	5139b2695e9bef33594a3926bd3e22ce.exe	97
PID 4416 wrote to memory of 4264	4416	5139b2695e9bef33594a3926bd3e22ce.exe	97

C:\Users\Admin\AppData\Local\Temp\5139b2695e9bef33594a3926bd3e22ce.exe
"C:\Users\Admin\AppData\Local\Temp\5139b2695e9bef33594a3926bd3e22ce.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 332
  2⤵
  - Program crash
  PID:4264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 332
  2⤵
  - Program crash
  PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4416 -ip 4416
1⤵
PID:5076

memory/4416-0-0x00000000005E0000-0x000000000064E000-memory.dmp

Filesize
440KB

Download