fc6d7cb3e579d7679e90cd2d4d9f4ec608af59a88e822104c0514079e705d004

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
15/01/2024, 02:22

Target
597c47748b3248690d79182a654fb392.exe
Size 246KB
Sample240115-ctsbbageb5
SHA256 fc6d7cb3e579d7679e90cd2d4d9f4ec608af59a88e822104c0514079e705d004
MD5 597c47748b3248690d79182a654fb392
SHA1 349e7e32850e8412a1bab55cf260841adcbd4a7f
SHA512 46ae853de55aa7579a2895c92bf7959f3ee985a2c327899f1252bb22aa6a45df03662a3560c05a4992aa5c1f33e5458c9761c9abb4e5d4bdfce909f021edda0d
SSDEEP 6144:9mNKk2Va43a0I8goqx2EOiicnd8ra6I7JZg0+XfbJUQCWf0gDMkWQc2:q43ajoqsdWd8rJO21f950CMR2
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4912	2916	WerFault.exe	54

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 4832	2916	597c47748b3248690d79182a654fb392.exe	89
PID 2916 wrote to memory of 4832	2916	597c47748b3248690d79182a654fb392.exe	89
PID 2916 wrote to memory of 4832	2916	597c47748b3248690d79182a654fb392.exe	89

C:\Users\Admin\AppData\Local\Temp\597c47748b3248690d79182a654fb392.exe
"C:\Users\Admin\AppData\Local\Temp\597c47748b3248690d79182a654fb392.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\597c47748b3248690d79182a654fb392.exe
  "C:\Users\Admin\AppData\Local\Temp\597c47748b3248690d79182a654fb392.exe"
  2⤵
  PID:4832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 324
  2⤵
  - Program crash
  PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2916 -ip 2916
1⤵
PID:4908

memory/2916-1-0x00000000005E0000-0x00000000005E2000-memory.dmp

Download

memory/2916-0-0x0000000000400000-0x000000000040E000-memory.dmp

Download