6e82176449396ea6b244923e666e2147d5f0d5a64b969e2cbbbe983012f5ac90

Analysis

max time kernel
93s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05-02-2024 16:20

Target

9273fd041c614dcc2258b7e77b783985.exe
Size

1.5MB
MD5

9273fd041c614dcc2258b7e77b783985
SHA1

2f9b8bda7e6e348e444af9b06ec25f190d787476
SHA256

6e82176449396ea6b244923e666e2147d5f0d5a64b969e2cbbbe983012f5ac90
SHA512

eb0f330806a54d441cee1bfc30fe41cbf7c45ef7e3bc019c66fb7437eeb26ce005326ae68bfe3cac10bc6aef5e8958722dea027845747cf6c9f42ac75b4c69ad
SSDEEP

24576:IyWIZgw76clTM6eX6yR3AlO6Qz1dWCvObbE179BxOfpeICljWmNvOC+QElbya1vD:gIyMi6eXf3AXQaCO47XO4bjWRQElnlD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3236	3348	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3348 wrote to memory of 3108	3348	9273fd041c614dcc2258b7e77b783985.exe	84
PID 3348 wrote to memory of 3108	3348	9273fd041c614dcc2258b7e77b783985.exe	84
PID 3348 wrote to memory of 3108	3348	9273fd041c614dcc2258b7e77b783985.exe	84

C:\Users\Admin\AppData\Local\Temp\9273fd041c614dcc2258b7e77b783985.exe
"C:\Users\Admin\AppData\Local\Temp\9273fd041c614dcc2258b7e77b783985.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Users\Admin\AppData\Local\Temp\9273fd041c614dcc2258b7e77b783985.exe
  "C:\Users\Admin\AppData\Local\Temp\9273fd041c614dcc2258b7e77b783985.exe"
  2⤵
  PID:3108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3348 -s 292
  2⤵
  - Program crash
  PID:3236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3348 -ip 3348
1⤵
PID:1052

memory/3348-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3348-1-0x00000000004E0000-0x00000000004E2000-memory.dmp

Filesize
8KB

Download