33d3af05d1fcf28764c48629687647f8a765d4dfccee946a470356366f521387

Analysis

max time kernel
135s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
20-01-2024 13:38

Target

6a9209198711b88b06ed9834692ca1c8.exe
Size

250KB
MD5

6a9209198711b88b06ed9834692ca1c8
SHA1

1f25855e8d81f9898689edbfbc0458a862d29663
SHA256

33d3af05d1fcf28764c48629687647f8a765d4dfccee946a470356366f521387
SHA512

35142e44c94cd2fceb726ed0ebf5065878bf0a085d3092a6f8e7302033cb885da163a1d8fc61d23f23280257a3f2aacd67add75d0cd949cc55157cbdde169d99
SSDEEP

3072:svecvGokz8uuewZe4qhkALYf+M2cOaiT62nSxZv1xFddEnkwoJIlePAm1AdV:svNKz8ZFZP6k+htxtSfrw6IRiAX

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2028 1772 WerFault.exe 6a9209198711b88b06ed9834692ca1c8.exe

pid	pid_target	process	target process
2028	1772	WerFault.exe	6a9209198711b88b06ed9834692ca1c8.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

6a9209198711b88b06ed9834692ca1c8.exe

description	pid	process	target process
PID 1772 wrote to memory of 4024	1772	6a9209198711b88b06ed9834692ca1c8.exe	6a9209198711b88b06ed9834692ca1c8.exe
PID 1772 wrote to memory of 4024	1772	6a9209198711b88b06ed9834692ca1c8.exe	6a9209198711b88b06ed9834692ca1c8.exe
PID 1772 wrote to memory of 4024	1772	6a9209198711b88b06ed9834692ca1c8.exe	6a9209198711b88b06ed9834692ca1c8.exe

C:\Users\Admin\AppData\Local\Temp\6a9209198711b88b06ed9834692ca1c8.exe
"C:\Users\Admin\AppData\Local\Temp\6a9209198711b88b06ed9834692ca1c8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1772

C:\Users\Admin\AppData\Local\Temp\6a9209198711b88b06ed9834692ca1c8.exe
"C:\Users\Admin\AppData\Local\Temp\6a9209198711b88b06ed9834692ca1c8.exe"
2⤵
PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 504
2⤵
- Program crash
PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1772 -ip 1772
1⤵
PID:896

memory/1772-1-0x0000000000B90000-0x0000000000B92000-memory.dmp

Filesize
8KB

Download
memory/1772-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download