99200990542dee7794486cd828fa4883502037d620a39be5eb16beb94085b2b2

Analysis

max time kernel
141s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 05:01

Target

d54380f953e1ec9581130143c4922eb5.exe
Size

243KB
MD5

d54380f953e1ec9581130143c4922eb5
SHA1

79d16728373632ce6ff1153541f0323085069539
SHA256

99200990542dee7794486cd828fa4883502037d620a39be5eb16beb94085b2b2
SHA512

c8a6c2e1ba703a3d7c5313a6f87f81c2ba8a5302e661c84b8af2d61d7b4472c0e7e6369cbe56ef1c460b698ce6bbe78fc9229e4d4030a1a2708d310f98b4fb97
SSDEEP

6144:N0/4jkcyqO3YcK7fD2RysX+001urGFCbeY/B0ZiLwkTFG:W/4TyT8KRQ000UKlp+oTF

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3640 5000 WerFault.exe d54380f953e1ec9581130143c4922eb5.exe
3088 5000 WerFault.exe d54380f953e1ec9581130143c4922eb5.exe

pid	pid_target	process	target process
3640	5000	WerFault.exe	d54380f953e1ec9581130143c4922eb5.exe
3088	5000	WerFault.exe	d54380f953e1ec9581130143c4922eb5.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

d54380f953e1ec9581130143c4922eb5.exe

description	pid	process	target process
PID 5000 wrote to memory of 3640	5000	d54380f953e1ec9581130143c4922eb5.exe	WerFault.exe
PID 5000 wrote to memory of 3640	5000	d54380f953e1ec9581130143c4922eb5.exe	WerFault.exe
PID 5000 wrote to memory of 3640	5000	d54380f953e1ec9581130143c4922eb5.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\d54380f953e1ec9581130143c4922eb5.exe
"C:\Users\Admin\AppData\Local\Temp\d54380f953e1ec9581130143c4922eb5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 424
2⤵
- Program crash
PID:3640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 424
2⤵
- Program crash
PID:3088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 5000 -ip 5000
1⤵
PID:2968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:2704