e67f8a804bdbeb0cd9be8de25f41c251eda9eaa38f44a937cbf9bb0c304d1530

Resubmissions

25/05/2024, 15:55

25/05/2024, 15:46

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 15:46

Target
c4ee18d4a484321620bef6ddd00fc620.exe
Size 231KB
Sample240525-s738qsaa28
SHA256 4fa4620f075ed6875b96da8c661287fc12c586ddc524c866a6861a6a94a26bee
MD5 c4ee18d4a484321620bef6ddd00fc620
SHA1 0bb6e51bbd66dfa5afacf3e12ab9789252f2ff57
SHA512 563a9e23b48fe1cffb21e73dc92a611bae2431d6a5d2b50d77745169254f2818603c1fda6d2fea3e3b4ce450a94e9a72e62c5bf1f1e4c0ff5e478880a0575b60
SSDEEP 6144:qK90Si3cX/ljsdbhmuUhmA3gOETfcfmcb2pY:q50XidohmdOufcOcb1
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3928	4856	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 1528	4856	c4ee18d4a484321620bef6ddd00fc620.exe	84
PID 4856 wrote to memory of 1528	4856	c4ee18d4a484321620bef6ddd00fc620.exe	84
PID 4856 wrote to memory of 1528	4856	c4ee18d4a484321620bef6ddd00fc620.exe	84

C:\Users\Admin\AppData\Local\Temp\c4ee18d4a484321620bef6ddd00fc620.exe
"C:\Users\Admin\AppData\Local\Temp\c4ee18d4a484321620bef6ddd00fc620.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Users\Admin\AppData\Local\Temp\c4ee18d4a484321620bef6ddd00fc620.exe
  "C:\Users\Admin\AppData\Local\Temp\c4ee18d4a484321620bef6ddd00fc620.exe"
  2⤵
  PID:1528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 424
  2⤵
  - Program crash
  PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4856 -ip 4856
1⤵
PID:3884

memory/4856-2-0x0000000002050000-0x0000000002052000-memory.dmp

Download

memory/4856-1-0x00000000000A0000-0x00000000001A0000-memory.dmp

Download