dedfb7f92808e48feb04d401fdd7cac5f4951c1e6b31601f1b901f894d29398d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 04:15

Target
ada9f3fef02806076da84b549a873261.exe
Size 293KB
Sample240229-evlk9sda7s
SHA256 dedfb7f92808e48feb04d401fdd7cac5f4951c1e6b31601f1b901f894d29398d
MD5 ada9f3fef02806076da84b549a873261
SHA1 1a215556d81e885d9b179dc46d037742d047b72b
SHA512 e664dfe09736bb22606b990493d8066caacc8727401a2c03f350a3044e86615b2609ffc41e16ee8da0f8f103a03cc57bcb74127f1441580f5a97c683cca419e2
SSDEEP 6144:A0fSeECNROmftNgyBxJy97rmvFZJf1VcrWRY5Jo2CSExtzva9Yua6:FKeElmngyBxq7KvFffUrWR8KxE9Y0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2908	828	WerFault.exe	55

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 932	828	ada9f3fef02806076da84b549a873261.exe	89
PID 828 wrote to memory of 932	828	ada9f3fef02806076da84b549a873261.exe	89
PID 828 wrote to memory of 932	828	ada9f3fef02806076da84b549a873261.exe	89

C:\Users\Admin\AppData\Local\Temp\ada9f3fef02806076da84b549a873261.exe
"C:\Users\Admin\AppData\Local\Temp\ada9f3fef02806076da84b549a873261.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Users\Admin\AppData\Local\Temp\ada9f3fef02806076da84b549a873261.exe
  "C:\Users\Admin\AppData\Local\Temp\ada9f3fef02806076da84b549a873261.exe"
  2⤵
  PID:932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 276
  2⤵
  - Program crash
  PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 828 -ip 828
1⤵
PID:1344

memory/828-0-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/828-1-0x00000000004D0000-0x00000000004D2000-memory.dmp

Download