d66c034380086e36912b8865f41b0dc3ea540a014ec42579ac9645dca5ae4858

Analysis

max time kernel
90s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
15/02/2024, 22:26

Target
9eb9ce6fa80e866fccb277b400033685.exe
Size 517KB
Sample240215-2ch4raba38
SHA256 d66c034380086e36912b8865f41b0dc3ea540a014ec42579ac9645dca5ae4858
MD5 9eb9ce6fa80e866fccb277b400033685
SHA1 4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8
SHA512 16bea65d58a3f968110411b067ea7cbdb4cab5ebd1edbf9d94428fed1bc0e40741c799b0c4d6ddd9de3e87f18322416924f03478a6041f8566f64f7bded9e760
SSDEEP 12288:Eg8tD+p1h79i/DdVedE5fJD7uwkIPveEosOgGSgSkrcq3qilOL:EgwVDdcE5fJheEovgYSkwq3qis
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4712	1648	WerFault.exe	24

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 456	1648	9eb9ce6fa80e866fccb277b400033685.exe	85
PID 1648 wrote to memory of 456	1648	9eb9ce6fa80e866fccb277b400033685.exe	85
PID 1648 wrote to memory of 456	1648	9eb9ce6fa80e866fccb277b400033685.exe	85

C:\Users\Admin\AppData\Local\Temp\9eb9ce6fa80e866fccb277b400033685.exe
"C:\Users\Admin\AppData\Local\Temp\9eb9ce6fa80e866fccb277b400033685.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Users\Admin\AppData\Local\Temp\9eb9ce6fa80e866fccb277b400033685.exe
  "C:\Users\Admin\AppData\Local\Temp\9eb9ce6fa80e866fccb277b400033685.exe"
  2⤵
  PID:456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 432
  2⤵
  - Program crash
  PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1648 -ip 1648
1⤵
PID:2096

memory/1648-0-0x00000000002D0000-0x000000000031F000-memory.dmp

Download

memory/1648-1-0x000000000EAF0000-0x000000000EAF2000-memory.dmp

Download