588be3b08f83d07a707390599f0cf936e401ed307318d24e9fdc91f66903b3a3

Analysis

max time kernel
137s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
17/01/2024, 03:11

Target
6197843be7a6c4c892e011badb7cc197.exe
Size 333KB
Sample240117-dpklcagec9
SHA256 588be3b08f83d07a707390599f0cf936e401ed307318d24e9fdc91f66903b3a3
MD5 6197843be7a6c4c892e011badb7cc197
SHA1 2081fb0235323290ee7adef233a171607a81bb49
SHA512 7376c9dde62f77fd43e5418e9945888776e1c0b1541dbd9d87d4b6a2a45e8bce70de3f6dd6ba2504201c801bb252564c0575c3d5663a5d2cf7adcaf27409b80e
SSDEEP 6144:aX9Y66H/Bcgqh3SB+sPeex/aHeKOILYPohjObwYJ42GTHdwhhfaB:aCPH/O0+DexUOI8PSjVHwhhG
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5108	1660	WerFault.exe	54

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 4692	1660	6197843be7a6c4c892e011badb7cc197.exe	88
PID 1660 wrote to memory of 4692	1660	6197843be7a6c4c892e011badb7cc197.exe	88
PID 1660 wrote to memory of 4692	1660	6197843be7a6c4c892e011badb7cc197.exe	88

C:\Users\Admin\AppData\Local\Temp\6197843be7a6c4c892e011badb7cc197.exe
"C:\Users\Admin\AppData\Local\Temp\6197843be7a6c4c892e011badb7cc197.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Users\Admin\AppData\Local\Temp\6197843be7a6c4c892e011badb7cc197.exe
  "C:\Users\Admin\AppData\Local\Temp\6197843be7a6c4c892e011badb7cc197.exe"
  2⤵
  PID:4692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 316
  2⤵
  - Program crash
  PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1660 -ip 1660
1⤵
PID:3760

memory/1660-1-0x00000000000A0000-0x00000000001A0000-memory.dmp

Download

memory/1660-2-0x00000000037E0000-0x00000000037E2000-memory.dmp

Download