a41947ab7b221611ce5bd65a7700a7abdf23f359ecdc14a717d29b0a671bfb24

Analysis

max time kernel
134s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 11:19

Target

a41947ab7b221611ce5bd65a7700a7abdf23f359ecdc14a717d29b0a671bfb24.exe
Size

122KB
MD5

0ef1e14bb0207f018b5d6085481609a1
SHA1

368629f335e1b322b6920ffd7e7b3606091df2de
SHA256

a41947ab7b221611ce5bd65a7700a7abdf23f359ecdc14a717d29b0a671bfb24
SHA512

bbcf150568533fdc84725dc401552abb27f879cb2accf41585e9b44033d1381711c7b5a676b99ed24ef6d927019e54d17d6e6222a2bbc9ba361613d36a2f6d56
SSDEEP

3072:hWELgkOggRksB41cj4d179gEuZYk+viPs30:8ELgkOVCuj4d179TaYfv+

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2548 set thread context of 3284	2548	a41947ab7b221611ce5bd65a7700a7abdf23f359ecdc14a717d29b0a671bfb24.exe	80

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\c8vj.job	a41947ab7b221611ce5bd65a7700a7abdf23f359ecdc14a717d29b0a671bfb24.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2304	2548	WerFault.exe	79

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 3284	2548	a41947ab7b221611ce5bd65a7700a7abdf23f359ecdc14a717d29b0a671bfb24.exe	80
PID 2548 wrote to memory of 3284	2548	a41947ab7b221611ce5bd65a7700a7abdf23f359ecdc14a717d29b0a671bfb24.exe	80
PID 2548 wrote to memory of 3284	2548	a41947ab7b221611ce5bd65a7700a7abdf23f359ecdc14a717d29b0a671bfb24.exe	80
PID 2548 wrote to memory of 3284	2548	a41947ab7b221611ce5bd65a7700a7abdf23f359ecdc14a717d29b0a671bfb24.exe	80
PID 2548 wrote to memory of 3284	2548	a41947ab7b221611ce5bd65a7700a7abdf23f359ecdc14a717d29b0a671bfb24.exe	80

C:\Users\Admin\AppData\Local\Temp\a41947ab7b221611ce5bd65a7700a7abdf23f359ecdc14a717d29b0a671bfb24.exe
"C:\Users\Admin\AppData\Local\Temp\a41947ab7b221611ce5bd65a7700a7abdf23f359ecdc14a717d29b0a671bfb24.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Users\Admin\AppData\Local\Temp\a41947ab7b221611ce5bd65a7700a7abdf23f359ecdc14a717d29b0a671bfb24.exe
  C:\Users\Admin\AppData\Local\Temp\a41947ab7b221611ce5bd65a7700a7abdf23f359ecdc14a717d29b0a671bfb24.exe
  2⤵
  - Drops file in Windows directory
  PID:3284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 344
  2⤵
  - Program crash
  PID:2304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2548 -ip 2548
1⤵
PID:2056

memory/3284-133-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3284-134-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3284-135-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3284-136-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download