abc081806594d320fc53365c4c71be47bd25bf5b647def7b8dd0239f24ff1843

Analysis

max time kernel
68s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2022, 00:16

Target
abc081806594d320fc53365c4c71be47bd25bf5b647de.exe
Size 239KB
Sample220818-akf6ksefgl
SHA256 abc081806594d320fc53365c4c71be47bd25bf5b647def7b8dd0239f24ff1843
MD5 e4d85cc21747aaef59bd5d6ee1aaf568
SHA1 26c5c0ac558002f837c596c3e3255646bd8cd554
SHA512 a4ff3f8d63232a5f4176751dafad657198ba6c77aef30d53ade20be25bbe89b04a67761b179caaf71b3fc91f0ef124eca388bfdba770cc6925357a47d22e5a9f
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1744 set thread context of 4908	1744	abc081806594d320fc53365c4c71be47bd25bf5b647de.exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3772	1744	WerFault.exe	81

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 4908	1744	abc081806594d320fc53365c4c71be47bd25bf5b647de.exe	82
PID 1744 wrote to memory of 4908	1744	abc081806594d320fc53365c4c71be47bd25bf5b647de.exe	82
PID 1744 wrote to memory of 4908	1744	abc081806594d320fc53365c4c71be47bd25bf5b647de.exe	82
PID 1744 wrote to memory of 4908	1744	abc081806594d320fc53365c4c71be47bd25bf5b647de.exe	82
PID 1744 wrote to memory of 4908	1744	abc081806594d320fc53365c4c71be47bd25bf5b647de.exe	82

C:\Users\Admin\AppData\Local\Temp\abc081806594d320fc53365c4c71be47bd25bf5b647de.exe
"C:\Users\Admin\AppData\Local\Temp\abc081806594d320fc53365c4c71be47bd25bf5b647de.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:4908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 276
  2⤵
  - Program crash
  PID:3772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1744 -ip 1744
1⤵
PID:1124

memory/1744-140-0x00000000003E0000-0x000000000041D000-memory.dmp

Download

memory/4908-133-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4908-141-0x0000000000400000-0x0000000000412000-memory.dmp

Download