42c053cd225026c1a26fb071b79d2de9137b25099aa843277ef1158c062b0d18

Analysis

max time kernel
151s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 11:27

Target

5654bbc59e7d5615d04494bb9a93347b.exe
Size

814KB
MD5

5654bbc59e7d5615d04494bb9a93347b
SHA1

7db5c996b9b77c6650822a3e1f6806450787c1d3
SHA256

42c053cd225026c1a26fb071b79d2de9137b25099aa843277ef1158c062b0d18
SHA512

2e2ad40514c5687f15650e3f20bacde54fff1e7b25513b52a7d26fd06033e79495e24ca01ffba925db3282aede4e59a6c76eba0b7360dc4d2e3e57a8d958c5fc
SSDEEP

12288:4uW/t47xKxfifqQtEub2EXudlDxDoAPRps0iyHZnmnK4bZ0jh0KV430FU+8YGJxX:4N/t4FABWF5GlDBl1ZjV4kLyX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4596	1560	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 3472	1560	5654bbc59e7d5615d04494bb9a93347b.exe	90
PID 1560 wrote to memory of 3472	1560	5654bbc59e7d5615d04494bb9a93347b.exe	90
PID 1560 wrote to memory of 3472	1560	5654bbc59e7d5615d04494bb9a93347b.exe	90

C:\Users\Admin\AppData\Local\Temp\5654bbc59e7d5615d04494bb9a93347b.exe
"C:\Users\Admin\AppData\Local\Temp\5654bbc59e7d5615d04494bb9a93347b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Users\Admin\AppData\Local\Temp\5654bbc59e7d5615d04494bb9a93347b.exe
  C:\Users\Admin\AppData\Local\Temp\5654bbc59e7d5615d04494bb9a93347b.exe
  2⤵
  PID:3472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 416
  2⤵
  - Program crash
  PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1560 -ip 1560
1⤵
PID:4172

memory/1560-0-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/1560-1-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download