b0add85e4e09ef3ac8f4940e98ee17054eeb63f58d68e49e2c0686a2ff7e0ef1

Analysis

max time kernel
68s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2022, 04:21

Target
b0add85e4e09ef3ac8f4940e98ee17054eeb63f58d68e.exe
Size 239KB
Sample220818-eym89sccb4
SHA256 b0add85e4e09ef3ac8f4940e98ee17054eeb63f58d68e49e2c0686a2ff7e0ef1
MD5 2eb2d4dc60b185e1961746b120d45f97
SHA1 b98896c24acd04d7532b4d72371ae6932a125872
SHA512 6ee54fd146dfa7bb95a6f6ca271bc832140c9df00cf3622803a0fe6c25b38a30a9b9da4d5f5d9f2104de9e86eecc2725ebc6122f801a07b63d221b0b2be83116
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3312 set thread context of 2568	3312	b0add85e4e09ef3ac8f4940e98ee17054eeb63f58d68e.exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3688	3312	WerFault.exe	81

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 2568	3312	b0add85e4e09ef3ac8f4940e98ee17054eeb63f58d68e.exe	82
PID 3312 wrote to memory of 2568	3312	b0add85e4e09ef3ac8f4940e98ee17054eeb63f58d68e.exe	82
PID 3312 wrote to memory of 2568	3312	b0add85e4e09ef3ac8f4940e98ee17054eeb63f58d68e.exe	82
PID 3312 wrote to memory of 2568	3312	b0add85e4e09ef3ac8f4940e98ee17054eeb63f58d68e.exe	82
PID 3312 wrote to memory of 2568	3312	b0add85e4e09ef3ac8f4940e98ee17054eeb63f58d68e.exe	82

C:\Users\Admin\AppData\Local\Temp\b0add85e4e09ef3ac8f4940e98ee17054eeb63f58d68e.exe
"C:\Users\Admin\AppData\Local\Temp\b0add85e4e09ef3ac8f4940e98ee17054eeb63f58d68e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:2568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 276
  2⤵
  - Program crash
  PID:3688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3312 -ip 3312
1⤵
PID:4300

memory/2568-133-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2568-140-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3312-141-0x00000000006E0000-0x000000000071D000-memory.dmp

Download