0e810c50e2676505ef3960731de72a0e342bc3587529866698ed822f793c3ddb

Analysis

max time kernel
132s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 07:54

Target

96aa0154b40ca3e37555424c12f2cf7b.exe
Size

70KB
MD5

96aa0154b40ca3e37555424c12f2cf7b
SHA1

887cd05622b8ed53b72b9f2df08760f2c37a9909
SHA256

0e810c50e2676505ef3960731de72a0e342bc3587529866698ed822f793c3ddb
SHA512

d0a4d80a1daf470fac0de9671b8fee5cb112a59e4af5288eac12a4ee74fee02a4bc427dde43aba8be08f8aa730fd866908f1e00b23a2be7610d6a6d7effbf0b1
SSDEEP

768:ulip4J+QTyVidaQrN/u7LWsKVCMZEiUdaGlJ+X1yITC54P8wHM+PgHeN2oGSSVh8:CuMaUJcLWsdriSH+jTCqPBMl88Scj

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4984	2976	WerFault.exe	83
4412	2976	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 4984	2976	96aa0154b40ca3e37555424c12f2cf7b.exe	88
PID 2976 wrote to memory of 4984	2976	96aa0154b40ca3e37555424c12f2cf7b.exe	88
PID 2976 wrote to memory of 4984	2976	96aa0154b40ca3e37555424c12f2cf7b.exe	88

C:\Users\Admin\AppData\Local\Temp\96aa0154b40ca3e37555424c12f2cf7b.exe
"C:\Users\Admin\AppData\Local\Temp\96aa0154b40ca3e37555424c12f2cf7b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 408
  2⤵
  - Program crash
  PID:4984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 408
  2⤵
  - Program crash
  PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2976 -ip 2976
1⤵
PID:1680

memory/2976-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2976-1-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download