6c0500777810d95ae34a634c1da09e433b25afc74bbff209191d8007a1dbabfa

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 00:26

Target

54fd18487036ed920ba2c709d0e08140.exe
Size

31KB
MD5

54fd18487036ed920ba2c709d0e08140
SHA1

0707aa6fd56eed8ca99ae3dd05b706beaacc3a01
SHA256

6c0500777810d95ae34a634c1da09e433b25afc74bbff209191d8007a1dbabfa
SHA512

03466f76717c1ba8a7bcbb73fe41f7334e1c81bd4b1086a5beda4a83ccd416ec4f87c6692f9a84281d8c2ff2ced9664c2ef4f1ab140828241a146e262e18ce83
SSDEEP

768:P1Yx7TzWB4iyfTeiZiVWShwE0nj0L7rTLu9fgUV:iJ1nE0j8rTa9L

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3096	1752	WerFault.exe	39

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 3520	1752	54fd18487036ed920ba2c709d0e08140.exe	51
PID 1752 wrote to memory of 3520	1752	54fd18487036ed920ba2c709d0e08140.exe	51
PID 1752 wrote to memory of 3520	1752	54fd18487036ed920ba2c709d0e08140.exe	51
PID 1752 wrote to memory of 3520	1752	54fd18487036ed920ba2c709d0e08140.exe	51

C:\Users\Admin\AppData\Local\Temp\54fd18487036ed920ba2c709d0e08140.exe
"C:\Users\Admin\AppData\Local\Temp\54fd18487036ed920ba2c709d0e08140.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 572
  2⤵
  - Program crash
  PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1752 -ip 1752
1⤵
PID:2768

memory/1752-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1752-1-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1752-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1752-7-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3520-2-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3520-3-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download