144c0fcf6f803810d13f85bb4541c9916eb80e0d0d59bd24e03b5dd9159710df

Analysis

Target

file.exe
Size

879KB
MD5

bd2b464bbcc0e12f585c3d300d4b7fc5
SHA1

3fa46371470b2c92898e85e9b34f2462360f79be
SHA256

144c0fcf6f803810d13f85bb4541c9916eb80e0d0d59bd24e03b5dd9159710df
SHA512

c8fe242280f34b25fd96d2035f33c0fc06a33d887ce64717f4a4e5c8dd38b5e4bea38125563efb18f95696514d96fb0e4aae5433e49d6439c10f3e248cb1bf3a
SSDEEP

24576:IKJ47SlzspERub0FCJVlvh7Ng6sCpgGMouSzNKkC1lMIftWkHvWA7:T45IftWkHvW

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 1444 set thread context of 844 1444 file.exe file.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

304 844 WerFault.exe file.exe

description	pid	process	target process
PID 1444 set thread context of 844	1444	file.exe	file.exe

pid	pid_target	process	target process
304	844	WerFault.exe	file.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

file.exefile.exe

description	pid	process	target process
PID 1444 wrote to memory of 844	1444	file.exe	file.exe
PID 1444 wrote to memory of 844	1444	file.exe	file.exe
PID 1444 wrote to memory of 844	1444	file.exe	file.exe
PID 1444 wrote to memory of 844	1444	file.exe	file.exe
PID 1444 wrote to memory of 844	1444	file.exe	file.exe
PID 1444 wrote to memory of 844	1444	file.exe	file.exe
PID 1444 wrote to memory of 844	1444	file.exe	file.exe
PID 1444 wrote to memory of 844	1444	file.exe	file.exe
PID 1444 wrote to memory of 844	1444	file.exe	file.exe
PID 1444 wrote to memory of 844	1444	file.exe	file.exe
PID 844 wrote to memory of 304	844	file.exe	WerFault.exe
PID 844 wrote to memory of 304	844	file.exe	WerFault.exe
PID 844 wrote to memory of 304	844	file.exe	WerFault.exe
PID 844 wrote to memory of 304	844	file.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 96
3⤵
- Program crash
PID:304

memory/304-73-0x0000000000000000-mapping.dmp

Download
memory/844-55-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/844-62-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/844-60-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/844-58-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/844-64-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/844-56-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/844-65-0x000000000009436C-mapping.dmp

Download
memory/844-69-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/844-72-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/1444-54-0x00000000001D0000-0x00000000002AF000-memory.dmp

Filesize
892KB

Download