0b78c4768ab3a67eea964ab66503d84e7faa1b8a0c61b32ad62de05cd184872d

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2022, 03:31

Target
185161916288344ed8e6f6c2348c7564.exe
Size 239KB
Sample220818-d22emagfgj
SHA256 0b78c4768ab3a67eea964ab66503d84e7faa1b8a0c61b32ad62de05cd184872d
MD5 185161916288344ed8e6f6c2348c7564
SHA1 2b3d919bfd4ed4acf57e078da2c7ce24140fddbb
SHA512 fe5f147ff92d81547cffff1d20276794127cb9093e2dfbf8fd76654ed0a8523a8f66f699969fe0bc721891c68b6f71af4199be9beb5d321708e8ebd88cc4e853
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2132 set thread context of 4964	2132	185161916288344ed8e6f6c2348c7564.exe	80

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8	2132	WerFault.exe	79

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 4964	2132	185161916288344ed8e6f6c2348c7564.exe	80
PID 2132 wrote to memory of 4964	2132	185161916288344ed8e6f6c2348c7564.exe	80
PID 2132 wrote to memory of 4964	2132	185161916288344ed8e6f6c2348c7564.exe	80
PID 2132 wrote to memory of 4964	2132	185161916288344ed8e6f6c2348c7564.exe	80
PID 2132 wrote to memory of 4964	2132	185161916288344ed8e6f6c2348c7564.exe	80

C:\Users\Admin\AppData\Local\Temp\185161916288344ed8e6f6c2348c7564.exe
"C:\Users\Admin\AppData\Local\Temp\185161916288344ed8e6f6c2348c7564.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:4964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 296
  2⤵
  - Program crash
  PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2132 -ip 2132
1⤵
PID:4532

memory/2132-141-0x0000000000720000-0x000000000075D000-memory.dmp

Download

memory/4964-133-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4964-140-0x0000000000400000-0x0000000000412000-memory.dmp

Download