bf2ff855f89ad45878467eac6bf7b7d542ff0b6df5c9f8043ec4500991b1dd16

Analysis

max time kernel
112s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2022, 22:26

Target
546fe52abc46667e9dc1833d3bb912ca.exe
Size 239KB
Sample220817-2chg8agef4
SHA256 bf2ff855f89ad45878467eac6bf7b7d542ff0b6df5c9f8043ec4500991b1dd16
MD5 546fe52abc46667e9dc1833d3bb912ca
SHA1 a6f5abd3545f65f4ad3bc33855e8b32e4a9476df
SHA512 01cbb881fb44440069e429f5a85805ce3e1bf4ccd26c79c48eacdeac17da5795151215b8b959db06b7acf742410abbe5447d5f28256c07be43b15e91530fab11
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2852 set thread context of 1520	2852	546fe52abc46667e9dc1833d3bb912ca.exe	84

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1656	2852	WerFault.exe	80

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 1520	2852	546fe52abc46667e9dc1833d3bb912ca.exe	84
PID 2852 wrote to memory of 1520	2852	546fe52abc46667e9dc1833d3bb912ca.exe	84
PID 2852 wrote to memory of 1520	2852	546fe52abc46667e9dc1833d3bb912ca.exe	84
PID 2852 wrote to memory of 1520	2852	546fe52abc46667e9dc1833d3bb912ca.exe	84
PID 2852 wrote to memory of 1520	2852	546fe52abc46667e9dc1833d3bb912ca.exe	84

C:\Users\Admin\AppData\Local\Temp\546fe52abc46667e9dc1833d3bb912ca.exe
"C:\Users\Admin\AppData\Local\Temp\546fe52abc46667e9dc1833d3bb912ca.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:1520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 272
  2⤵
  - Program crash
  PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 2852 -ip 2852
1⤵
PID:3584

memory/1520-133-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1520-140-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2852-141-0x00000000003B0000-0x00000000003ED000-memory.dmp

Download