ef925865b194ddd0d59233fec99f8e3608a623c3d4f7eaaf34b9af57f9bb0a82

Analysis

max time kernel
135s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 06:35

Target
64b8ce71634358d220c7eb599a73556d.exe
Size 337KB
Sample240118-hcgfdafae9
SHA256 ef925865b194ddd0d59233fec99f8e3608a623c3d4f7eaaf34b9af57f9bb0a82
MD5 64b8ce71634358d220c7eb599a73556d
SHA1 06d0687b32181d1611d20c60078526850049e38b
SHA512 54ed51ed7ce72d0f4045b5a7f253ee88d503196085e0497fd4ef8599254bce570161da43b6ac949a15629f1f58777971696eaea6e4dd345e6ae0f8d698f48ba4
SSDEEP 6144:HzW9OawmfBcAqh3SBUjSLxRtx0RfoqZi378JHoAE3MXue5TUakec:HPlmfOUUjSlx0Rhi3WHon8JTUa9c
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1244	912	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 4004	912	64b8ce71634358d220c7eb599a73556d.exe	23
PID 912 wrote to memory of 4004	912	64b8ce71634358d220c7eb599a73556d.exe	23
PID 912 wrote to memory of 4004	912	64b8ce71634358d220c7eb599a73556d.exe	23

C:\Users\Admin\AppData\Local\Temp\64b8ce71634358d220c7eb599a73556d.exe
"C:\Users\Admin\AppData\Local\Temp\64b8ce71634358d220c7eb599a73556d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Users\Admin\AppData\Local\Temp\64b8ce71634358d220c7eb599a73556d.exe
  "C:\Users\Admin\AppData\Local\Temp\64b8ce71634358d220c7eb599a73556d.exe"
  2⤵
  PID:4004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 332
  2⤵
  - Program crash
  PID:1244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 912 -ip 912
1⤵
PID:2160

memory/912-2-0x00000000006F0000-0x00000000006F2000-memory.dmp

Download

memory/912-1-0x00000000000A0000-0x00000000001A0000-memory.dmp

Download