75cdc03e89729226eaefb9259aab9beb4052ddef0280bbf53dcaf8ef9f58d917

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 10:05

Target

75cdc03e89729226eaefb9259aab9beb4052ddef0280bbf53dcaf8ef9f58d917.exe
Size

1.2MB
MD5

8e009a43143d3afdde5e91b311e4018b
SHA1

332f1f946b6aaadecb3de55c5880d0c61021073f
SHA256

75cdc03e89729226eaefb9259aab9beb4052ddef0280bbf53dcaf8ef9f58d917
SHA512

2db471514d4720afed163a576b7c25ce6e45bf46c129ce03ebaa1422e588dcbe16a6107fd34fb7606f6b57e0a5623bbe0ce314584ddd060639a1f6e9345daf24
SSDEEP

24576:YqDEvCTbMWu7rQYlBQcBiT6rprG8a+z74Zcy9xCN6:YTvC/MTQYxsWR7a+vyn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3824	4892	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 4540	4892	75cdc03e89729226eaefb9259aab9beb4052ddef0280bbf53dcaf8ef9f58d917.exe	84
PID 4892 wrote to memory of 4540	4892	75cdc03e89729226eaefb9259aab9beb4052ddef0280bbf53dcaf8ef9f58d917.exe	84
PID 4892 wrote to memory of 4540	4892	75cdc03e89729226eaefb9259aab9beb4052ddef0280bbf53dcaf8ef9f58d917.exe	84

C:\Users\Admin\AppData\Local\Temp\75cdc03e89729226eaefb9259aab9beb4052ddef0280bbf53dcaf8ef9f58d917.exe
"C:\Users\Admin\AppData\Local\Temp\75cdc03e89729226eaefb9259aab9beb4052ddef0280bbf53dcaf8ef9f58d917.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\75cdc03e89729226eaefb9259aab9beb4052ddef0280bbf53dcaf8ef9f58d917.exe"
  2⤵
  PID:4540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 656
  2⤵
  - Program crash
  PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4892 -ip 4892
1⤵
PID:3680

C:\Users\Admin\AppData\Local\Temp\aut4323.tmp

Filesize
264KB

MD5
3b92c7c7e1d069d027090bbb8c4c6b3c

SHA1
473ee15a3c0adf847ed03b6861ee051c78e6384c

SHA256
297d72a6ca8e98558823b71f551ec72508b1adcec64596d41387978fd0ffbd54

SHA512
d5c52ddd13ab9b2a47159c46fa8e50e54794977d5740abfa2b6ba0456ad0381750110749804ffc771213189be1cdca1ec89c174e87c72c71af3d1ca4f7300e4e

Download Submit
memory/4892-12-0x0000000001B20000-0x0000000001B24000-memory.dmp

Filesize
16KB

Download