fac8270504cdabfe27f578981bdda24afee15f62e625c9fec23283ca1b70a73e

Analysis

max time kernel
162s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 01:01

Target

fac8270504cdabfe27f578981bdda24afee15f62e625c9fec23283ca1b70a73e.exe
Size

5.5MB
MD5

02a809777a7398df95a6a82435fd3fb0
SHA1

4e097b2faeb18fd03e447177817124578d24b302
SHA256

fac8270504cdabfe27f578981bdda24afee15f62e625c9fec23283ca1b70a73e
SHA512

5f87d181ad75952c4ec3cfa7c6a3959e7229e99a242f314686a50c31acb7543816c96e9cf9f4b527bd1ad2d2d49f94800942398b8ff797fa46f41d66bdd6e92c
SSDEEP

98304:hD9TU0gdhGReu+P23HxuEJ+pt4ydy0X1gsVPmfrH69UfTUwni7R0I3TlFgQV:hqrgez8Hxul/4WlpVkrgX+Q

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4448	4060	WerFault.exe	94
2484	4060	WerFault.exe	94

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4060	fac8270504cdabfe27f578981bdda24afee15f62e625c9fec23283ca1b70a73e.exe
4060	fac8270504cdabfe27f578981bdda24afee15f62e625c9fec23283ca1b70a73e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 4448	4060	fac8270504cdabfe27f578981bdda24afee15f62e625c9fec23283ca1b70a73e.exe	100
PID 4060 wrote to memory of 4448	4060	fac8270504cdabfe27f578981bdda24afee15f62e625c9fec23283ca1b70a73e.exe	100
PID 4060 wrote to memory of 4448	4060	fac8270504cdabfe27f578981bdda24afee15f62e625c9fec23283ca1b70a73e.exe	100

C:\Users\Admin\AppData\Local\Temp\fac8270504cdabfe27f578981bdda24afee15f62e625c9fec23283ca1b70a73e.exe
"C:\Users\Admin\AppData\Local\Temp\fac8270504cdabfe27f578981bdda24afee15f62e625c9fec23283ca1b70a73e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 300
  2⤵
  - Program crash
  PID:4448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 300
  2⤵
  - Program crash
  PID:2484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4060 -ip 4060
1⤵
PID:4284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3676 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:1544

memory/4060-0-0x0000000001000000-0x0000000001889000-memory.dmp

Filesize
8.5MB

Download
memory/4060-1-0x0000000001000000-0x0000000001889000-memory.dmp

Filesize
8.5MB

Download
memory/4060-2-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4060-3-0x0000000001000000-0x0000000001889000-memory.dmp

Filesize
8.5MB

Download