4c7a1db52ba369a0a43e2f6ebd817d4879229959a1616a927c7a6ec816dfd658

Analysis

max time kernel
129s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 02:05

Target

4c7a1db52ba369a0a43e2f6ebd817d4879229959a1616a927c7a6ec816dfd658.exe
Size

27KB
MD5

0c4c321c56560ae0eeb92639c301b350
SHA1

b1b4ac239b1d21e0f37f1de7fdf59186075bd93e
SHA256

4c7a1db52ba369a0a43e2f6ebd817d4879229959a1616a927c7a6ec816dfd658
SHA512

4e1ceaf7a293a4eabf5c8f11acf9f26c5a1b81865b18a6af6b6e5b8970c90d2022f2fbd996d692e62b6d151f0fbd392b8537e5aa6ff4475b1e200559a185b814
SSDEEP

384:/VcqL6uST1HY9jTzv3AVWBH3I0DKL3dxKwlZ/ub21QybPp1jHZ:/VcqGrT149j/3SWZIk4NVr/g21QI31

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4980 set thread context of 4916	4980	4c7a1db52ba369a0a43e2f6ebd817d4879229959a1616a927c7a6ec816dfd658.exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4800	4916	WerFault.exe	82

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 4916	4980	4c7a1db52ba369a0a43e2f6ebd817d4879229959a1616a927c7a6ec816dfd658.exe	82
PID 4980 wrote to memory of 4916	4980	4c7a1db52ba369a0a43e2f6ebd817d4879229959a1616a927c7a6ec816dfd658.exe	82
PID 4980 wrote to memory of 4916	4980	4c7a1db52ba369a0a43e2f6ebd817d4879229959a1616a927c7a6ec816dfd658.exe	82
PID 4980 wrote to memory of 4916	4980	4c7a1db52ba369a0a43e2f6ebd817d4879229959a1616a927c7a6ec816dfd658.exe	82
PID 4980 wrote to memory of 4916	4980	4c7a1db52ba369a0a43e2f6ebd817d4879229959a1616a927c7a6ec816dfd658.exe	82

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4916 -ip 4916
1⤵
PID:4896

memory/4916-133-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4980-134-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download