7f2e0645947bc96cd2f5edd2260db48f09102dcfd0fcd85896d287c1b621770d

Analysis

max time kernel
82s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2022, 09:02

Target
c1e3ea17284ebca7b5c35038855690c5.exe
Size 239KB
Sample220818-kzfhpscbcm
SHA256 7f2e0645947bc96cd2f5edd2260db48f09102dcfd0fcd85896d287c1b621770d
MD5 c1e3ea17284ebca7b5c35038855690c5
SHA1 d52abc57aefee3d69201367386cb06a4ba4449dd
SHA512 b048dc45fe081ee9ddd9b94d9d90191db90862b15566e17cddafdcacfc68449b546596480a100bb1727e8633e378b7d97408cb8b66ba18e06ade6f0b1c6d7a8e
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1516 set thread context of 3148	1516	c1e3ea17284ebca7b5c35038855690c5.exe	81

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4864	1516	WerFault.exe	80

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 3148	1516	c1e3ea17284ebca7b5c35038855690c5.exe	81
PID 1516 wrote to memory of 3148	1516	c1e3ea17284ebca7b5c35038855690c5.exe	81
PID 1516 wrote to memory of 3148	1516	c1e3ea17284ebca7b5c35038855690c5.exe	81
PID 1516 wrote to memory of 3148	1516	c1e3ea17284ebca7b5c35038855690c5.exe	81
PID 1516 wrote to memory of 3148	1516	c1e3ea17284ebca7b5c35038855690c5.exe	81

C:\Users\Admin\AppData\Local\Temp\c1e3ea17284ebca7b5c35038855690c5.exe
"C:\Users\Admin\AppData\Local\Temp\c1e3ea17284ebca7b5c35038855690c5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:3148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 276
  2⤵
  - Program crash
  PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1516 -ip 1516
1⤵
PID:4880

memory/1516-140-0x0000000000A70000-0x0000000000AAD000-memory.dmp

Download

memory/3148-133-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3148-141-0x0000000000400000-0x0000000000412000-memory.dmp

Download