cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327

Analysis

max time kernel
140s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 14:12

Target

cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327.exe
Size

624KB
MD5

9ec8468dd4a81b0b35c499b31e67375e
SHA1

6fa04992c0624c7aa3ca80da6a30e6de91226a16
SHA256

cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327
SHA512

bd6b37a0395f0ae508c54dcb62d5258adfb8c202605db8310c6b8758c3874bd2364491b1b129209ba1854df27f35149f891ac785a89fe26ddc45c40cad8023b2
SSDEEP

12288:CpCB9AVqhPDUHvOdO21ai1m2Y+o1mQR5LaVfnkBUxarLIN8Wah5/wodPdv7PVTFe:Cp12UPQkBUO/B5/lzTVTFH+

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
208	1512	WerFault.exe	cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327.exe
1188	1512	WerFault.exe	cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327.exe

description	pid	process	target process
PID 1512 wrote to memory of 208	1512	cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327.exe	WerFault.exe
PID 1512 wrote to memory of 208	1512	cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327.exe	WerFault.exe
PID 1512 wrote to memory of 208	1512	cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327.exe
"C:\Users\Admin\AppData\Local\Temp\cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 484
  2⤵
  - Program crash
  PID:208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 484
  2⤵
  - Program crash
  PID:1188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1512 -ip 1512
1⤵
PID:3856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1312 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:4420