3f5bc52dbad154f0693d28e459ff19c203c93ec58d6d99fa86631b049ba9746a

Analysis

Target
54f5f7c5c74cb688f97f99aef2279beb.exe
Size 510KB
Sample210109-tkdgfe3lts
SHA256 3f5bc52dbad154f0693d28e459ff19c203c93ec58d6d99fa86631b049ba9746a
MD5 54f5f7c5c74cb688f97f99aef2279beb
SHA1 31725afd3e58fcf3d58994860b403327fb9c27a7
SHA512 45589c1f24ed2df8827c2a45fbefb84f10bfb69e5d30f59a423e5737ccbb99da22cd27d9ae658e23065dbdd9e26f95981742e84d085bb4a87957a84e4e859b6e
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 500 set thread context of 3536	500	54f5f7c5c74cb688f97f99aef2279beb.exe	78

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
500	54f5f7c5c74cb688f97f99aef2279beb.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
500	54f5f7c5c74cb688f97f99aef2279beb.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 500 wrote to memory of 3536	500	54f5f7c5c74cb688f97f99aef2279beb.exe	78
PID 500 wrote to memory of 3536	500	54f5f7c5c74cb688f97f99aef2279beb.exe	78
PID 500 wrote to memory of 3536	500	54f5f7c5c74cb688f97f99aef2279beb.exe	78
PID 500 wrote to memory of 3536	500	54f5f7c5c74cb688f97f99aef2279beb.exe	78
PID 500 wrote to memory of 3536	500	54f5f7c5c74cb688f97f99aef2279beb.exe	78

C:\Users\Admin\AppData\Local\Temp\54f5f7c5c74cb688f97f99aef2279beb.exe
"C:\Users\Admin\AppData\Local\Temp\54f5f7c5c74cb688f97f99aef2279beb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:500
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe
  2⤵
  PID:3536

memory/500-2-0x00000000046D6000-0x00000000046D7000-memory.dmp

Download

memory/500-3-0x0000000004990000-0x0000000004991000-memory.dmp

Download

memory/500-5-0x00000000004B0000-0x0000000000539000-memory.dmp

Download

memory/500-8-0x0000000000890000-0x0000000000959000-memory.dmp

Download