f6b30a3195b740a4dd8464d29bfb7bdbd860bbfd48a5a3e4b7c9a655d5d5fd3c

Analysis

max time kernel
90s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2022, 17:31

Target
670081ff1c3f7c9232949c576623f9a7.exe
Size 235KB
Sample220817-v3pkwsaffj
SHA256 f6b30a3195b740a4dd8464d29bfb7bdbd860bbfd48a5a3e4b7c9a655d5d5fd3c
MD5 670081ff1c3f7c9232949c576623f9a7
SHA1 d47d4f6f06455cd55e9a0aaa04d0684cc5da7b31
SHA512 ec08c48f58395a7ccf2ffdf4eca6c399082ddbe260f9fb24cc5a70885caffe0f8385187ef828989436f3d166fe0648567c5f21d2c3c42923871e21f1f64d0ad1
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5096 set thread context of 1296	5096	670081ff1c3f7c9232949c576623f9a7.exe	81

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4928	5096	WerFault.exe	79

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 1296	5096	670081ff1c3f7c9232949c576623f9a7.exe	81
PID 5096 wrote to memory of 1296	5096	670081ff1c3f7c9232949c576623f9a7.exe	81
PID 5096 wrote to memory of 1296	5096	670081ff1c3f7c9232949c576623f9a7.exe	81
PID 5096 wrote to memory of 1296	5096	670081ff1c3f7c9232949c576623f9a7.exe	81
PID 5096 wrote to memory of 1296	5096	670081ff1c3f7c9232949c576623f9a7.exe	81

C:\Users\Admin\AppData\Local\Temp\670081ff1c3f7c9232949c576623f9a7.exe
"C:\Users\Admin\AppData\Local\Temp\670081ff1c3f7c9232949c576623f9a7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:1296
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 276
  2⤵
  - Program crash
  PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5096 -ip 5096
1⤵
PID:2216

memory/1296-133-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1296-140-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/5096-141-0x0000000000440000-0x000000000047D000-memory.dmp

Download