86c4ba92aa9c2e4ffb3234f459e967e3575e635b2072a25226769a79b839d5a4

Analysis

max time kernel
133s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 01:28

Target

86c4ba92aa9c2e4ffb3234f459e967e3575e635b2072a25226769a79b839d5a4.exe
Size

1.4MB
MD5

dc8eedb26f69c04bf2afa1437869534c
SHA1

1a28a55a415501c1c02452f01fd3596eb5f7c9c2
SHA256

86c4ba92aa9c2e4ffb3234f459e967e3575e635b2072a25226769a79b839d5a4
SHA512

118bf9f3d8758f37c6ef0dc6251d1b24dbdd6e31a3427df15709cba53dbc78bbfbc0c703efe3504072d45dd29ed780a3c22c4b0dc0bb08e013546575b4096424
SSDEEP

24576:EqDEvCTbMWu7rQYlBQcBiT6rprG8a+t7kkWmOFEjF:ETvC/MTQYxsWR7a+1kkWmMu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2504	512	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 512 wrote to memory of 3708	512	86c4ba92aa9c2e4ffb3234f459e967e3575e635b2072a25226769a79b839d5a4.exe	87
PID 512 wrote to memory of 3708	512	86c4ba92aa9c2e4ffb3234f459e967e3575e635b2072a25226769a79b839d5a4.exe	87
PID 512 wrote to memory of 3708	512	86c4ba92aa9c2e4ffb3234f459e967e3575e635b2072a25226769a79b839d5a4.exe	87

C:\Users\Admin\AppData\Local\Temp\86c4ba92aa9c2e4ffb3234f459e967e3575e635b2072a25226769a79b839d5a4.exe
"C:\Users\Admin\AppData\Local\Temp\86c4ba92aa9c2e4ffb3234f459e967e3575e635b2072a25226769a79b839d5a4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:512
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\86c4ba92aa9c2e4ffb3234f459e967e3575e635b2072a25226769a79b839d5a4.exe"
  2⤵
  PID:3708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 660
  2⤵
  - Program crash
  PID:2504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 512 -ip 512
1⤵
PID:1644

C:\Users\Admin\AppData\Local\Temp\aut38A4.tmp

Filesize
262KB

MD5
b20f73c2bf95100c83d454d08e89f383

SHA1
197c1b22d6148eceb988b6c1cd9c4d6c2102bcbe

SHA256
45f843bde5ab55956803afeff4e831f69138be89703c04135d2508129b5de0a4

SHA512
a46bed62ccfdf1c0dcc1ea151cb70a9d0e05ed2f4fa0ad5a43116e4e6dd35b4c59891c9ad32962c87ccec34dc5d792297051546cf8a2a9523814ca5618850d6e

Download Submit
memory/512-12-0x0000000001970000-0x0000000001974000-memory.dmp

Filesize
16KB

Download