13170f7bc208837e594cfeca202a41013216d8ac4fddb0d2ab1ce2ea9b1f1879

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 15:29

Target

13170f7bc208837e594cfeca202a41013216d8ac4fddb0d2ab1ce2ea9b1f1879.exe
Size

27KB
MD5

2612650a6853a3be9d6b12d0314e9840
SHA1

b0fe07c1dd9134fbea09189135a745ad4abbb932
SHA256

13170f7bc208837e594cfeca202a41013216d8ac4fddb0d2ab1ce2ea9b1f1879
SHA512

f562e1d0e8e18066acfd578ec8b2c51c2d48371e0db8d1eb8ac1facea831ea8cb6c4c0cbe9b6102a11e0e8c88ce2a0f8a93a5ecd9737f33a054acf0955737380
SSDEEP

768:Gqs5/VR11yddoQlNxKm07E+AW9YxQI3U:GqMtRryfdwm0uWN

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4752 set thread context of 2836	4752	13170f7bc208837e594cfeca202a41013216d8ac4fddb0d2ab1ce2ea9b1f1879.exe	85

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4296	2836	WerFault.exe	85

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 2836	4752	13170f7bc208837e594cfeca202a41013216d8ac4fddb0d2ab1ce2ea9b1f1879.exe	85
PID 4752 wrote to memory of 2836	4752	13170f7bc208837e594cfeca202a41013216d8ac4fddb0d2ab1ce2ea9b1f1879.exe	85
PID 4752 wrote to memory of 2836	4752	13170f7bc208837e594cfeca202a41013216d8ac4fddb0d2ab1ce2ea9b1f1879.exe	85
PID 4752 wrote to memory of 2836	4752	13170f7bc208837e594cfeca202a41013216d8ac4fddb0d2ab1ce2ea9b1f1879.exe	85
PID 4752 wrote to memory of 2836	4752	13170f7bc208837e594cfeca202a41013216d8ac4fddb0d2ab1ce2ea9b1f1879.exe	85

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2836 -ip 2836
1⤵
PID:4240

memory/2836-133-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4752-134-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download