0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076

Analysis

Target

0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe
Size

594KB
MD5

0faf60f6b58a9280cd519653658a95a7
SHA1

5f24e4075ebc1e44747093a996e346e013004821
SHA256

0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076
SHA512

b1ee924b7a13819e8d0bbd36226093183bd9e5cb4d91021866d1f61aa69ada6174c19854ba30469e232c6e15e4f0f2ad040f315d47484a27c9dc97fbc337ead5

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe

description	pid	process	target process
PID 4116 set thread context of 532	4116	0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe	0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1292 532 WerFault.exe 0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe

pid	pid_target	process	target process
1292	532	WerFault.exe	0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe

pid	process
4116	0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe
4116	0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe

description	pid	process	target process
PID 4116 wrote to memory of 532	4116	0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe	0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe
PID 4116 wrote to memory of 532	4116	0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe	0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe
PID 4116 wrote to memory of 532	4116	0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe	0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe
PID 4116 wrote to memory of 532	4116	0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe	0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe

C:\Users\Admin\AppData\Local\Temp\0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe
"C:\Users\Admin\AppData\Local\Temp\0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe"
2⤵
PID:532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 532 -s 396
3⤵
- Program crash
PID:1292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 532 -ip 532
1⤵
PID:1436

memory/4116-131-0x00000000012FD000-0x0000000001300000-memory.dmp

Filesize
12KB

Download