9eaeb9eea8637cf35afdd5955009560f41ee72e46b42346c18d377285cfd199f

Analysis

max time kernel
91s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 15:18

Target

9eaeb9eea8637cf35afdd5955009560f41ee72e46b42346c18d377285cfd199f.exe
Size

286KB
MD5

6cbf418ea4c3f288b9e4924993453f18
SHA1

82a515c1a5de7c763b8675b22c26603f0a955af0
SHA256

9eaeb9eea8637cf35afdd5955009560f41ee72e46b42346c18d377285cfd199f
SHA512

7dd31f584684c8bdfe1cabf0a94b29bd552bb00c96d4810f08cecc9b8b10f0222b4e92b9d94207de9e23dd9e2de3f78ce7bc2345ac95908f5c9fc98659a83d35
SSDEEP

6144:NhWxjk0EdatAbulIY24k43n6fJRMNHVYwFZqJtu:NOjk0gatIW0WZKs

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5024 set thread context of 372	5024	9eaeb9eea8637cf35afdd5955009560f41ee72e46b42346c18d377285cfd199f.exe	86

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2404	5024	WerFault.exe	81
1472	5024	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
372	9eaeb9eea8637cf35afdd5955009560f41ee72e46b42346c18d377285cfd199f.exe
372	9eaeb9eea8637cf35afdd5955009560f41ee72e46b42346c18d377285cfd199f.exe
372	9eaeb9eea8637cf35afdd5955009560f41ee72e46b42346c18d377285cfd199f.exe
372	9eaeb9eea8637cf35afdd5955009560f41ee72e46b42346c18d377285cfd199f.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 372	5024	9eaeb9eea8637cf35afdd5955009560f41ee72e46b42346c18d377285cfd199f.exe	86
PID 5024 wrote to memory of 372	5024	9eaeb9eea8637cf35afdd5955009560f41ee72e46b42346c18d377285cfd199f.exe	86
PID 5024 wrote to memory of 372	5024	9eaeb9eea8637cf35afdd5955009560f41ee72e46b42346c18d377285cfd199f.exe	86
PID 5024 wrote to memory of 372	5024	9eaeb9eea8637cf35afdd5955009560f41ee72e46b42346c18d377285cfd199f.exe	86
PID 5024 wrote to memory of 372	5024	9eaeb9eea8637cf35afdd5955009560f41ee72e46b42346c18d377285cfd199f.exe	86
PID 5024 wrote to memory of 372	5024	9eaeb9eea8637cf35afdd5955009560f41ee72e46b42346c18d377285cfd199f.exe	86
PID 5024 wrote to memory of 372	5024	9eaeb9eea8637cf35afdd5955009560f41ee72e46b42346c18d377285cfd199f.exe	86
PID 372 wrote to memory of 2640	372	9eaeb9eea8637cf35afdd5955009560f41ee72e46b42346c18d377285cfd199f.exe	57
PID 372 wrote to memory of 2640	372	9eaeb9eea8637cf35afdd5955009560f41ee72e46b42346c18d377285cfd199f.exe	57
PID 372 wrote to memory of 2640	372	9eaeb9eea8637cf35afdd5955009560f41ee72e46b42346c18d377285cfd199f.exe	57
PID 372 wrote to memory of 2640	372	9eaeb9eea8637cf35afdd5955009560f41ee72e46b42346c18d377285cfd199f.exe	57

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5024 -ip 5024
1⤵
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5024 -ip 5024
1⤵
PID:2352

memory/372-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/372-135-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/372-137-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2640-136-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download