bdc216cbe87a4b199452a3f7b756972640b43dd5f930aede19c83464d1ab4806

Analysis

max time kernel
141s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 07:29

Target

bdc216cbe87a4b199452a3f7b756972640b43dd5f930aede19c83464d1ab4806.exe
Size

72KB
MD5

e5abb6c874dd499a91a800d3fcf7da3b
SHA1

4fad1d1d36e11f934ed8f597688110a6bd73c905
SHA256

bdc216cbe87a4b199452a3f7b756972640b43dd5f930aede19c83464d1ab4806
SHA512

7267aea6c64130495a6b1ad1229f867a4bdac44635a0ba8c6f9fc56b0ce09800a5d73536d6d30d547bd888fd5c1e758e798e5b2dfcf11e145e9e2bfbfd80ec69
SSDEEP

768:09qXSI9VJTQZzzv/bwW33X33eLvgwhqPGdSksG+YRkXIoDvjwB0SNGBZSbGYIDU7:jnEIWnXnutyk4+k4obeZMBcb5IYIe

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3828 set thread context of 4696	3828	bdc216cbe87a4b199452a3f7b756972640b43dd5f930aede19c83464d1ab4806.exe	80

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4640	4696	WerFault.exe	80

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3828	bdc216cbe87a4b199452a3f7b756972640b43dd5f930aede19c83464d1ab4806.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 4696	3828	bdc216cbe87a4b199452a3f7b756972640b43dd5f930aede19c83464d1ab4806.exe	80
PID 3828 wrote to memory of 4696	3828	bdc216cbe87a4b199452a3f7b756972640b43dd5f930aede19c83464d1ab4806.exe	80
PID 3828 wrote to memory of 4696	3828	bdc216cbe87a4b199452a3f7b756972640b43dd5f930aede19c83464d1ab4806.exe	80
PID 3828 wrote to memory of 4696	3828	bdc216cbe87a4b199452a3f7b756972640b43dd5f930aede19c83464d1ab4806.exe	80
PID 3828 wrote to memory of 4696	3828	bdc216cbe87a4b199452a3f7b756972640b43dd5f930aede19c83464d1ab4806.exe	80
PID 3828 wrote to memory of 4696	3828	bdc216cbe87a4b199452a3f7b756972640b43dd5f930aede19c83464d1ab4806.exe	80
PID 3828 wrote to memory of 4696	3828	bdc216cbe87a4b199452a3f7b756972640b43dd5f930aede19c83464d1ab4806.exe	80

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4696 -ip 4696
1⤵
PID:4744

memory/4696-136-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/4696-135-0x0000000000400200-0x0000000000400400-memory.dmp

Filesize
512B

Download
memory/4696-134-0x0000000000000000-mapping.dmp

Download