f3c9bf81953f0762bd21cd1786e6482a51389a495e59d7dd2c7e5a9473ac45a7

Analysis

max time kernel
148s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 01:01

Target

f3c9bf81953f0762bd21cd1786e6482a51389a495e59d7dd2c7e5a9473ac45a7.exe
Size

97KB
MD5

3c10689832fb307635f0ce790c363c68
SHA1

0d3e862c13883f26d2cd2026048b43cb744311b5
SHA256

f3c9bf81953f0762bd21cd1786e6482a51389a495e59d7dd2c7e5a9473ac45a7
SHA512

00923128daa232defc78cc838252f30a9ba7b5a45866d17025d6913f8f52f7f26e5b7178be222cf403dc015b8ac17177af9e240cb1243d75dc75e527bc350d1f
SSDEEP

1536:ZEhyoVP5YktNJtAfhh4szc37BTqjeEb4spYglM8cCas84Lzd:sNJtChh4sg7B8eEU8llMxqXd

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4856 set thread context of 2456	4856	f3c9bf81953f0762bd21cd1786e6482a51389a495e59d7dd2c7e5a9473ac45a7.exe	85

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2140	4856	WerFault.exe	83

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 2456	4856	f3c9bf81953f0762bd21cd1786e6482a51389a495e59d7dd2c7e5a9473ac45a7.exe	85
PID 4856 wrote to memory of 2456	4856	f3c9bf81953f0762bd21cd1786e6482a51389a495e59d7dd2c7e5a9473ac45a7.exe	85
PID 4856 wrote to memory of 2456	4856	f3c9bf81953f0762bd21cd1786e6482a51389a495e59d7dd2c7e5a9473ac45a7.exe	85
PID 4856 wrote to memory of 2456	4856	f3c9bf81953f0762bd21cd1786e6482a51389a495e59d7dd2c7e5a9473ac45a7.exe	85
PID 4856 wrote to memory of 2456	4856	f3c9bf81953f0762bd21cd1786e6482a51389a495e59d7dd2c7e5a9473ac45a7.exe	85

C:\Users\Admin\AppData\Local\Temp\f3c9bf81953f0762bd21cd1786e6482a51389a495e59d7dd2c7e5a9473ac45a7.exe
"C:\Users\Admin\AppData\Local\Temp\f3c9bf81953f0762bd21cd1786e6482a51389a495e59d7dd2c7e5a9473ac45a7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Users\Admin\AppData\Local\Temp\f3c9bf81953f0762bd21cd1786e6482a51389a495e59d7dd2c7e5a9473ac45a7.exe
  C:\Users\Admin\AppData\Local\Temp\f3c9bf81953f0762bd21cd1786e6482a51389a495e59d7dd2c7e5a9473ac45a7.exe
  2⤵
  PID:2456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 292
  2⤵
  - Program crash
  PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4856 -ip 4856
1⤵
PID:4160

memory/2456-133-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download