7179fcb3469bbfb096f43703ef4dc1cf29971cc325bb66f9ce26e9eaa2a83d00

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2022, 03:01

Target
bf84f9098a2faf3d60bddcfe405ea5de.exe
Size 239KB
Sample220818-dhwd9sgdaq
SHA256 7179fcb3469bbfb096f43703ef4dc1cf29971cc325bb66f9ce26e9eaa2a83d00
MD5 bf84f9098a2faf3d60bddcfe405ea5de
SHA1 e056b5c49f2dbe40290d314d7ccd7f0f3e109b71
SHA512 c49063d9b201a55cd68f2f601eed159ed7a2f5d9ccd6cc66f7ce407bc1b59fd0e201effde9f30efaecfde4ed84a1d94268019d4d42614e94139b1d42411f01b7
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3564 set thread context of 4936	3564	bf84f9098a2faf3d60bddcfe405ea5de.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5112	3564	WerFault.exe	82

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 4936	3564	bf84f9098a2faf3d60bddcfe405ea5de.exe	83
PID 3564 wrote to memory of 4936	3564	bf84f9098a2faf3d60bddcfe405ea5de.exe	83
PID 3564 wrote to memory of 4936	3564	bf84f9098a2faf3d60bddcfe405ea5de.exe	83
PID 3564 wrote to memory of 4936	3564	bf84f9098a2faf3d60bddcfe405ea5de.exe	83
PID 3564 wrote to memory of 4936	3564	bf84f9098a2faf3d60bddcfe405ea5de.exe	83

C:\Users\Admin\AppData\Local\Temp\bf84f9098a2faf3d60bddcfe405ea5de.exe
"C:\Users\Admin\AppData\Local\Temp\bf84f9098a2faf3d60bddcfe405ea5de.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:4936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 292
  2⤵
  - Program crash
  PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3564 -ip 3564
1⤵
PID:3436

memory/3564-141-0x0000000000950000-0x000000000098D000-memory.dmp

Download

memory/4936-133-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4936-140-0x0000000000400000-0x0000000000412000-memory.dmp

Download