03adc87359fab868e57f1f099a098f7eb13e2d04488bd135d99ceb56ba34820e

Analysis

max time kernel
90s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2022, 00:31

Target

03adc87359fab868e57f1f099a098f7eb13e2d04488bd135d99ceb56ba34820e.exe
Size

322KB
MD5

36706e405660e620487d13a4dfe5465f
SHA1

905215c21b54b57dc815d5cdf54cd0a0a6240842
SHA256

03adc87359fab868e57f1f099a098f7eb13e2d04488bd135d99ceb56ba34820e
SHA512

1f976164b19c71f776902c99a4abe1384601cf4ed9db423ea680065fe282a981c006af59414f8df50b9c9339827070d895488e71780c6a91c5d1d147ae2b210a
SSDEEP

6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4736 set thread context of 2288	4736	03adc87359fab868e57f1f099a098f7eb13e2d04488bd135d99ceb56ba34820e.exe	77

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2328	2288	WerFault.exe	77

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2288	03adc87359fab868e57f1f099a098f7eb13e2d04488bd135d99ceb56ba34820e.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 2288	4736	03adc87359fab868e57f1f099a098f7eb13e2d04488bd135d99ceb56ba34820e.exe	77
PID 4736 wrote to memory of 2288	4736	03adc87359fab868e57f1f099a098f7eb13e2d04488bd135d99ceb56ba34820e.exe	77
PID 4736 wrote to memory of 2288	4736	03adc87359fab868e57f1f099a098f7eb13e2d04488bd135d99ceb56ba34820e.exe	77
PID 4736 wrote to memory of 2288	4736	03adc87359fab868e57f1f099a098f7eb13e2d04488bd135d99ceb56ba34820e.exe	77
PID 4736 wrote to memory of 2288	4736	03adc87359fab868e57f1f099a098f7eb13e2d04488bd135d99ceb56ba34820e.exe	77
PID 4736 wrote to memory of 2288	4736	03adc87359fab868e57f1f099a098f7eb13e2d04488bd135d99ceb56ba34820e.exe	77
PID 4736 wrote to memory of 2288	4736	03adc87359fab868e57f1f099a098f7eb13e2d04488bd135d99ceb56ba34820e.exe	77
PID 4736 wrote to memory of 2288	4736	03adc87359fab868e57f1f099a098f7eb13e2d04488bd135d99ceb56ba34820e.exe	77
PID 4736 wrote to memory of 2288	4736	03adc87359fab868e57f1f099a098f7eb13e2d04488bd135d99ceb56ba34820e.exe	77

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2288 -ip 2288
1⤵
PID:1072

memory/2288-138-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4736-132-0x0000000000CB0000-0x0000000000D06000-memory.dmp

Filesize
344KB

Download
memory/4736-133-0x0000000008220000-0x00000000087C4000-memory.dmp

Filesize
5.6MB

Download
memory/4736-134-0x0000000007C70000-0x0000000007D02000-memory.dmp

Filesize
584KB

Download
memory/4736-135-0x00000000089D0000-0x0000000008A46000-memory.dmp

Filesize
472KB

Download
memory/4736-136-0x00000000057E0000-0x00000000057FE000-memory.dmp

Filesize
120KB

Download