8fb7d7c33173d49da7907bf7bec5eea3d7d7f79ea3fef39bedf3de4b22f76987

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 22:55

Target
bd047836bb8805934054d02d6d4263f6.exe
Size 512KB
Sample240309-2v4headf5z
SHA256 8fb7d7c33173d49da7907bf7bec5eea3d7d7f79ea3fef39bedf3de4b22f76987
MD5 bd047836bb8805934054d02d6d4263f6
SHA1 235a213a7bb4fc944199ec54a04138c0c4d0150d
SHA512 532c65ddde7cac5d06ce54283f62625783082d2c186f24246ed24d32334a1cf0adb1e489ef027308b76c2620b8565c735a5a2d3ec0b67f4e845d91ea4e1ba634
SSDEEP 12288:TKhCCCCCCCCCCCCC1g5al+tpTQTujAyfiIsdCCCCCCCCCCCCCCCCCCC/c2XvB5+5:TKnfSIT+L4M6U/QjortrtmHTdSqBV+
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2128	2256	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2964	2256	bd047836bb8805934054d02d6d4263f6.exe	90
PID 2256 wrote to memory of 2964	2256	bd047836bb8805934054d02d6d4263f6.exe	90
PID 2256 wrote to memory of 2964	2256	bd047836bb8805934054d02d6d4263f6.exe	90

C:\Users\Admin\AppData\Local\Temp\bd047836bb8805934054d02d6d4263f6.exe
"C:\Users\Admin\AppData\Local\Temp\bd047836bb8805934054d02d6d4263f6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\bd047836bb8805934054d02d6d4263f6.exe
  "C:\Users\Admin\AppData\Local\Temp\bd047836bb8805934054d02d6d4263f6.exe"
  2⤵
  PID:2964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 432
  2⤵
  - Program crash
  PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2256 -ip 2256
1⤵
PID:3136

memory/2256-1-0x0000000000460000-0x0000000000462000-memory.dmp

Download

memory/2256-0-0x0000000000400000-0x0000000000405000-memory.dmp

Download