6f34b2ab28775ef0a1efb6b9cb7642842145daeb2b153087a01ab26515d4efe4

Analysis

max time kernel
92s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 10:10

Target

aba21fc0aa72794ae223a14b9731be08.exe
Size

595KB
MD5

aba21fc0aa72794ae223a14b9731be08
SHA1

b43fd16261116e17d7d6e4cdb90d2a326daa8d91
SHA256

6f34b2ab28775ef0a1efb6b9cb7642842145daeb2b153087a01ab26515d4efe4
SHA512

eaf7689941f43bc511d6374b87ff4932aef1d1866c5de11c9ba800cce9a197c610e4243ba343244c9a187433dfc158ef32d2d4d0819acaaceaaa211fe8a8fbad
SSDEEP

12288:lAHWgKie267njcAaRkOlIIH2pVNAapVeEwcUjw/Hpxz:9gKq67nQzkDNAapVebbw/JN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4988	1168	WerFault.exe	48

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 2556	1168	aba21fc0aa72794ae223a14b9731be08.exe	90
PID 1168 wrote to memory of 2556	1168	aba21fc0aa72794ae223a14b9731be08.exe	90
PID 1168 wrote to memory of 2556	1168	aba21fc0aa72794ae223a14b9731be08.exe	90

C:\Users\Admin\AppData\Local\Temp\aba21fc0aa72794ae223a14b9731be08.exe
"C:\Users\Admin\AppData\Local\Temp\aba21fc0aa72794ae223a14b9731be08.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Users\Admin\AppData\Local\Temp\aba21fc0aa72794ae223a14b9731be08.exe
  C:\Users\Admin\AppData\Local\Temp\aba21fc0aa72794ae223a14b9731be08.exe
  2⤵
  PID:2556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 468
  2⤵
  - Program crash
  PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 1168 -ip 1168
1⤵
PID:3972

memory/1168-0-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/1168-1-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/1168-2-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/1168-3-0x0000000000820000-0x0000000000821000-memory.dmp

Filesize
4KB

Download
memory/1168-4-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download