90a9ef1c549a9f2646f6c603e27570832f371d25d2fc4b967c96f55fa034e557

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14-01-2024 09:09

Target

5ad9f6be601fb9f23677c239c91deae2.exe
Size

313KB
MD5

5ad9f6be601fb9f23677c239c91deae2
SHA1

a0162b62231692e94ca41aac27cec6063179a9da
SHA256

90a9ef1c549a9f2646f6c603e27570832f371d25d2fc4b967c96f55fa034e557
SHA512

60d3f39a18811ac40c3b5d14e34eaac8334627545c703006f25e297b5f2fe3669715ea7e92a44f05991a0567a14a79c6f8a239651f85738ec30f61ae790a8737
SSDEEP

6144:Vd53TvpHeIl0yL6PKXDiFachVUGeUap2nRcUn3GYUKxn8gNMoPPUbyK+LwiwT6Z8:Vd53TvpHeIl0yL6muFxhSGeunagIsnBY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4324	1004	WerFault.exe	55

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 1180	1004	5ad9f6be601fb9f23677c239c91deae2.exe	91
PID 1004 wrote to memory of 1180	1004	5ad9f6be601fb9f23677c239c91deae2.exe	91
PID 1004 wrote to memory of 1180	1004	5ad9f6be601fb9f23677c239c91deae2.exe	91

C:\Users\Admin\AppData\Local\Temp\5ad9f6be601fb9f23677c239c91deae2.exe
"C:\Users\Admin\AppData\Local\Temp\5ad9f6be601fb9f23677c239c91deae2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Users\Admin\AppData\Local\Temp\5ad9f6be601fb9f23677c239c91deae2.exe
  "C:\Users\Admin\AppData\Local\Temp\5ad9f6be601fb9f23677c239c91deae2.exe"
  2⤵
  PID:1180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 364
  2⤵
  - Program crash
  PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1004 -ip 1004
1⤵
PID:3408

memory/1004-2-0x0000000000740000-0x0000000000742000-memory.dmp

Filesize
8KB

Download
memory/1004-1-0x00000000000A0000-0x00000000001A0000-memory.dmp

Filesize
1024KB

Download