b0f659c8061cdeebc18b31f3480a37662aa761e2da1ec2ac3ac026ceb2af9b8b

Analysis

max time kernel
138s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 20:37

Target

b0f659c8061cdeebc18b31f3480a37662aa761e2da1ec2ac3ac026ceb2af9b8b.exe
Size

53KB
MD5

a3525369bc96c90c56eba3ff53fc5790
SHA1

3f87fb00263ed9da9374d241c4d8caad5a874b42
SHA256

b0f659c8061cdeebc18b31f3480a37662aa761e2da1ec2ac3ac026ceb2af9b8b
SHA512

2a172db31c3bbf33e908c599aeff80217ab57f74f3adf578fa403aab13bdbb1c3ddb970882a218408d4c48319396b3f65dce13554773b7709caf52068fad7ef4
SSDEEP

768:DfPKHuQFXyTSPJeerrGY4P1SkrEYn+0aiP:DHKOQFSOe2GQkTaiP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2988 set thread context of 1208	2988	b0f659c8061cdeebc18b31f3480a37662aa761e2da1ec2ac3ac026ceb2af9b8b.exe	82

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4756	1208	WerFault.exe	82
4636	1208	WerFault.exe	82

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 1208	2988	b0f659c8061cdeebc18b31f3480a37662aa761e2da1ec2ac3ac026ceb2af9b8b.exe	82
PID 2988 wrote to memory of 1208	2988	b0f659c8061cdeebc18b31f3480a37662aa761e2da1ec2ac3ac026ceb2af9b8b.exe	82
PID 2988 wrote to memory of 1208	2988	b0f659c8061cdeebc18b31f3480a37662aa761e2da1ec2ac3ac026ceb2af9b8b.exe	82
PID 2988 wrote to memory of 1208	2988	b0f659c8061cdeebc18b31f3480a37662aa761e2da1ec2ac3ac026ceb2af9b8b.exe	82

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 1208 -ip 1208
1⤵
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1208 -ip 1208
1⤵
PID:4672

memory/1208-133-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download