215162379e6ff41f32a1fce51c9078ac715405735f3ad3bef17dfa04ed676457

Analysis

Target

215162379e6ff41f32a1fce51c9078ac715405735f3ad3bef17dfa04ed676457.exe
Size

284KB
MD5

bf2a8645f14f19ffac48ed3c1cf13115
SHA1

a0477457781068b5f8e2bf5cf3c3e484c3bcb375
SHA256

215162379e6ff41f32a1fce51c9078ac715405735f3ad3bef17dfa04ed676457
SHA512

34d2ff7c63c7daf47078fd05bd58988711c5fedef56fadacf890ea32f6c94b501c7df0918ab1d6c1dbe0e6f1a3234d71141b38e5c76e2777ca08c6f6e62ae3b5

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

215162379e6ff41f32a1fce51c9078ac715405735f3ad3bef17dfa04ed676457.exe

description	pid	process	target process
PID 1964 set thread context of 2908	1964	215162379e6ff41f32a1fce51c9078ac715405735f3ad3bef17dfa04ed676457.exe	215162379e6ff41f32a1fce51c9078ac715405735f3ad3bef17dfa04ed676457.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

215162379e6ff41f32a1fce51c9078ac715405735f3ad3bef17dfa04ed676457.exe

description	pid	process	target process
PID 1964 wrote to memory of 2908	1964	215162379e6ff41f32a1fce51c9078ac715405735f3ad3bef17dfa04ed676457.exe	215162379e6ff41f32a1fce51c9078ac715405735f3ad3bef17dfa04ed676457.exe
PID 1964 wrote to memory of 2908	1964	215162379e6ff41f32a1fce51c9078ac715405735f3ad3bef17dfa04ed676457.exe	215162379e6ff41f32a1fce51c9078ac715405735f3ad3bef17dfa04ed676457.exe
PID 1964 wrote to memory of 2908	1964	215162379e6ff41f32a1fce51c9078ac715405735f3ad3bef17dfa04ed676457.exe	215162379e6ff41f32a1fce51c9078ac715405735f3ad3bef17dfa04ed676457.exe
PID 1964 wrote to memory of 2908	1964	215162379e6ff41f32a1fce51c9078ac715405735f3ad3bef17dfa04ed676457.exe	215162379e6ff41f32a1fce51c9078ac715405735f3ad3bef17dfa04ed676457.exe

C:\Users\Admin\AppData\Local\Temp\215162379e6ff41f32a1fce51c9078ac715405735f3ad3bef17dfa04ed676457.exe
"C:\Users\Admin\AppData\Local\Temp\215162379e6ff41f32a1fce51c9078ac715405735f3ad3bef17dfa04ed676457.exe"
2⤵
PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2908 -ip 2908
1⤵
PID:2596

memory/1964-130-0x0000000074B90000-0x0000000075141000-memory.dmp

Filesize
5.7MB

Download
memory/1964-133-0x0000000074B90000-0x0000000075141000-memory.dmp

Filesize
5.7MB

Download
memory/2908-131-0x0000000000000000-mapping.dmp

Download