448eabfa9cdc6d1b612b3cd814adb2d5b15052b95def4dc5844048121ed2962a

Analysis

max time kernel
134s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 07:35

Target

98d6a26737adf58ab18fa0a861c526d7.exe
Size

88KB
MD5

98d6a26737adf58ab18fa0a861c526d7
SHA1

b4f162160d4e0b3c34369fe1e3cd1b3ef748ce4e
SHA256

448eabfa9cdc6d1b612b3cd814adb2d5b15052b95def4dc5844048121ed2962a
SHA512

54593b287b112ff0cf941ac458897544b9a6146d54671762ec8bd6cf56fde4a1bbf7aa22db4494bd1a8dc15cda04eb799b0825d0c9c8b3b07970ede3955cf2f4
SSDEEP

1536:VZSPy4amUf33T9J6pO0AgA0gvhT1otp2XMmuGYHopnJlIU:Vgof3D9JyO0u0g11otJhVHodJlIU

Score

3^/10

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4616	3404	WerFault.exe	83
4232	3404	WerFault.exe	83
648	3404	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 4616	3404	98d6a26737adf58ab18fa0a861c526d7.exe	86
PID 3404 wrote to memory of 4616	3404	98d6a26737adf58ab18fa0a861c526d7.exe	86
PID 3404 wrote to memory of 4616	3404	98d6a26737adf58ab18fa0a861c526d7.exe	86

C:\Users\Admin\AppData\Local\Temp\98d6a26737adf58ab18fa0a861c526d7.exe
"C:\Users\Admin\AppData\Local\Temp\98d6a26737adf58ab18fa0a861c526d7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 440
  2⤵
  - Program crash
  PID:4616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 440
  2⤵
  - Program crash
  PID:4232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 460
  2⤵
  - Program crash
  PID:648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3404 -ip 3404
1⤵
PID:1268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3404 -ip 3404
1⤵
PID:2384

memory/3404-0-0x0000000001000000-0x0000000001017000-memory.dmp

Filesize
92KB

Download