83cff282ac23b5cf0171f033f6a6b55136cdc9c041dff94309d6df29167ccca0

Analysis

max time kernel
134s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 12:56

Target

VirusShare_d01ba61fe82dba7b44123ba6b5ae6fdc.exe
Size

121KB
MD5

d01ba61fe82dba7b44123ba6b5ae6fdc
SHA1

f2280593b5405e9b3186e905e07acbb5534b1b2a
SHA256

83cff282ac23b5cf0171f033f6a6b55136cdc9c041dff94309d6df29167ccca0
SHA512

fdf09b19990809a52c1fda152237b0fcb6f98182789a71cd41354e596c991ecff5190eff754cc430fd5144aad67fd1d361eec6640ed070e2f3651956741f5630
SSDEEP

3072:kQSkOiooO77p4EeP7OnocHBgOiwV3Omk5uctKTYey:3SkOK814BPS9CTWemuuctKc

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3432	2860	WerFault.exe	82
4820	2860	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 3432	2860	VirusShare_d01ba61fe82dba7b44123ba6b5ae6fdc.exe	87
PID 2860 wrote to memory of 3432	2860	VirusShare_d01ba61fe82dba7b44123ba6b5ae6fdc.exe	87
PID 2860 wrote to memory of 3432	2860	VirusShare_d01ba61fe82dba7b44123ba6b5ae6fdc.exe	87

C:\Users\Admin\AppData\Local\Temp\VirusShare_d01ba61fe82dba7b44123ba6b5ae6fdc.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_d01ba61fe82dba7b44123ba6b5ae6fdc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 284
  2⤵
  - Program crash
  PID:3432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 284
  2⤵
  - Program crash
  PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 2860 -ip 2860
1⤵
PID:4348