8fb7d7c33173d49da7907bf7bec5eea3d7d7f79ea3fef39bedf3de4b22f76987

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-03-2024 22:55

Target

bd047836bb8805934054d02d6d4263f6.exe
Size

512KB
MD5

bd047836bb8805934054d02d6d4263f6
SHA1

235a213a7bb4fc944199ec54a04138c0c4d0150d
SHA256

8fb7d7c33173d49da7907bf7bec5eea3d7d7f79ea3fef39bedf3de4b22f76987
SHA512

532c65ddde7cac5d06ce54283f62625783082d2c186f24246ed24d32334a1cf0adb1e489ef027308b76c2620b8565c735a5a2d3ec0b67f4e845d91ea4e1ba634
SSDEEP

12288:TKhCCCCCCCCCCCCC1g5al+tpTQTujAyfiIsdCCCCCCCCCCCCCCCCCCC/c2XvB5+5:TKnfSIT+L4M6U/QjortrtmHTdSqBV+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2128	2256	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2964	2256	bd047836bb8805934054d02d6d4263f6.exe	90
PID 2256 wrote to memory of 2964	2256	bd047836bb8805934054d02d6d4263f6.exe	90
PID 2256 wrote to memory of 2964	2256	bd047836bb8805934054d02d6d4263f6.exe	90

C:\Users\Admin\AppData\Local\Temp\bd047836bb8805934054d02d6d4263f6.exe
"C:\Users\Admin\AppData\Local\Temp\bd047836bb8805934054d02d6d4263f6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\bd047836bb8805934054d02d6d4263f6.exe
  "C:\Users\Admin\AppData\Local\Temp\bd047836bb8805934054d02d6d4263f6.exe"
  2⤵
  PID:2964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 432
  2⤵
  - Program crash
  PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2256 -ip 2256
1⤵
PID:3136

memory/2256-1-0x0000000000460000-0x0000000000462000-memory.dmp

Filesize
8KB

Download
memory/2256-0-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download