d8d5547f803b193caa7f2585d30e19c805be69f21313cf0e9e059e4b93b6fb41

Analysis

max time kernel
145s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2022, 02:19

Target

d8d5547f803b193caa7f2585d30e19c805be69f21313cf0e9e059e4b93b6fb41.exe
Size

53KB
MD5

793cd0dd85d8d02a3681e634ba1db370
SHA1

afdc7ea77e7cf88c59006e054cb92bcfb368789d
SHA256

d8d5547f803b193caa7f2585d30e19c805be69f21313cf0e9e059e4b93b6fb41
SHA512

67da3a6dae8f3f26d6dc2d8bdb43102866777925cb57928950c3111c8e238f879d749d6b29a850d70694d436207103a5a66af26cda3ff268fcb1716d66233267
SSDEEP

768:mec8yXVUWT2qjScytZSjMr4vFHuj9ZhjzRYxXimDsOyuSCKRZtvf5Khhvr:lYXVuFbKqJdYxXimwLZXZtn5KhVr

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3020 set thread context of 4824	3020	d8d5547f803b193caa7f2585d30e19c805be69f21313cf0e9e059e4b93b6fb41.exe	81

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5048	3020	WerFault.exe	80
792	3020	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4824	d8d5547f803b193caa7f2585d30e19c805be69f21313cf0e9e059e4b93b6fb41.exe
4824	d8d5547f803b193caa7f2585d30e19c805be69f21313cf0e9e059e4b93b6fb41.exe
4824	d8d5547f803b193caa7f2585d30e19c805be69f21313cf0e9e059e4b93b6fb41.exe
4824	d8d5547f803b193caa7f2585d30e19c805be69f21313cf0e9e059e4b93b6fb41.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 4824	3020	d8d5547f803b193caa7f2585d30e19c805be69f21313cf0e9e059e4b93b6fb41.exe	81
PID 3020 wrote to memory of 4824	3020	d8d5547f803b193caa7f2585d30e19c805be69f21313cf0e9e059e4b93b6fb41.exe	81
PID 3020 wrote to memory of 4824	3020	d8d5547f803b193caa7f2585d30e19c805be69f21313cf0e9e059e4b93b6fb41.exe	81
PID 3020 wrote to memory of 4824	3020	d8d5547f803b193caa7f2585d30e19c805be69f21313cf0e9e059e4b93b6fb41.exe	81
PID 3020 wrote to memory of 4824	3020	d8d5547f803b193caa7f2585d30e19c805be69f21313cf0e9e059e4b93b6fb41.exe	81
PID 3020 wrote to memory of 5048	3020	d8d5547f803b193caa7f2585d30e19c805be69f21313cf0e9e059e4b93b6fb41.exe	86
PID 3020 wrote to memory of 5048	3020	d8d5547f803b193caa7f2585d30e19c805be69f21313cf0e9e059e4b93b6fb41.exe	86
PID 3020 wrote to memory of 5048	3020	d8d5547f803b193caa7f2585d30e19c805be69f21313cf0e9e059e4b93b6fb41.exe	86
PID 4824 wrote to memory of 2432	4824	d8d5547f803b193caa7f2585d30e19c805be69f21313cf0e9e059e4b93b6fb41.exe	36
PID 4824 wrote to memory of 2432	4824	d8d5547f803b193caa7f2585d30e19c805be69f21313cf0e9e059e4b93b6fb41.exe	36
PID 4824 wrote to memory of 2432	4824	d8d5547f803b193caa7f2585d30e19c805be69f21313cf0e9e059e4b93b6fb41.exe	36
PID 4824 wrote to memory of 2432	4824	d8d5547f803b193caa7f2585d30e19c805be69f21313cf0e9e059e4b93b6fb41.exe	36

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3020 -ip 3020
1⤵
PID:3436

memory/2432-138-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/4824-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4824-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4824-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4824-139-0x0000000000020000-0x0000000000032000-memory.dmp

Filesize
72KB

Download