6f1507120710fd267c7d2b6aa1d63cec192e4eb904675f260a8e2e18ebfc4b99

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2024, 15:20

Target
590c80702966f4024d6085f8927df3a3.exe
Size 315KB
Sample240113-sq683acdb7
SHA256 6f1507120710fd267c7d2b6aa1d63cec192e4eb904675f260a8e2e18ebfc4b99
MD5 590c80702966f4024d6085f8927df3a3
SHA1 c27114c70834520c1e020b2de504ef7ec1fc91e2
SHA512 7b898e0712be30b9c78f133191c21b5120aeb57afc729fc6dc5bb8c5ac5043d211ae78ce0337da0877c8b2c7165f3d7618b055f89d9dc5c7fe60efdac638f04a
SSDEEP 6144:1B/uJCdB0FBVDiOm6jp/Pm/+mlehH2BJ+eB5uD06ihdREos1ujEVa4t0hei:1luJLH8Om2PU+MYsrbuDJi1Eos1eE4jr
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
624	4916	WerFault.exe	53

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 2764	4916	590c80702966f4024d6085f8927df3a3.exe	88
PID 4916 wrote to memory of 2764	4916	590c80702966f4024d6085f8927df3a3.exe	88
PID 4916 wrote to memory of 2764	4916	590c80702966f4024d6085f8927df3a3.exe	88

C:\Users\Admin\AppData\Local\Temp\590c80702966f4024d6085f8927df3a3.exe
"C:\Users\Admin\AppData\Local\Temp\590c80702966f4024d6085f8927df3a3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Users\Admin\AppData\Local\Temp\590c80702966f4024d6085f8927df3a3.exe
  "C:\Users\Admin\AppData\Local\Temp\590c80702966f4024d6085f8927df3a3.exe"
  2⤵
  PID:2764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 300
  2⤵
  - Program crash
  PID:624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4916 -ip 4916
1⤵
PID:376

memory/4916-0-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4916-1-0x0000000000700000-0x0000000000702000-memory.dmp

Download