32c09c5ccebc048f83c67ef61fac00e7614daf8a0a2de7361ee89ec005a1c08e

Analysis

max time kernel
68s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2022, 23:21

Target
32c09c5ccebc048f83c67ef61fac00e7614daf8a0a2de.exe
Size 239KB
Sample220817-3by91shbd9
SHA256 32c09c5ccebc048f83c67ef61fac00e7614daf8a0a2de7361ee89ec005a1c08e
MD5 b5fb9531f7348743fba4626c5e95849e
SHA1 43b80848bb8250b15a28a6474e1552a516f9dcb1
SHA512 a6f801355fe04de0772d8876756e4cb08bd610ac0e95eae8a5ca547099397025f864a53d929c4cf5ac5fc3b16fe0ec57a3c55bb1c200db4cb128d84890605259
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 924 set thread context of 4712	924	32c09c5ccebc048f83c67ef61fac00e7614daf8a0a2de.exe	81

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4004	924	WerFault.exe	80

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 4712	924	32c09c5ccebc048f83c67ef61fac00e7614daf8a0a2de.exe	81
PID 924 wrote to memory of 4712	924	32c09c5ccebc048f83c67ef61fac00e7614daf8a0a2de.exe	81
PID 924 wrote to memory of 4712	924	32c09c5ccebc048f83c67ef61fac00e7614daf8a0a2de.exe	81
PID 924 wrote to memory of 4712	924	32c09c5ccebc048f83c67ef61fac00e7614daf8a0a2de.exe	81
PID 924 wrote to memory of 4712	924	32c09c5ccebc048f83c67ef61fac00e7614daf8a0a2de.exe	81

C:\Users\Admin\AppData\Local\Temp\32c09c5ccebc048f83c67ef61fac00e7614daf8a0a2de.exe
"C:\Users\Admin\AppData\Local\Temp\32c09c5ccebc048f83c67ef61fac00e7614daf8a0a2de.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:924
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:4712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 276
  2⤵
  - Program crash
  PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 924 -ip 924
1⤵
PID:5100

memory/924-132-0x0000000000B60000-0x0000000000B9D000-memory.dmp

Download

memory/924-142-0x0000000000B60000-0x0000000000B9D000-memory.dmp

Download

memory/4712-134-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4712-141-0x0000000000400000-0x0000000000412000-memory.dmp

Download