23c649ba9aec2c9778a6bd25081771cff40805934b95b9bcbea838fde106b251

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:46

Target

23c649ba9aec2c9778a6bd25081771cff40805934b95b9bcbea838fde106b251.exe
Size

264KB
MD5

478f6df9fed1c28cb898e57943308963
SHA1

4b50275dae988248e7b877b935ccc091a772278e
SHA256

23c649ba9aec2c9778a6bd25081771cff40805934b95b9bcbea838fde106b251
SHA512

5d0600d8524dba74bd3cd1727b27f7d096fd66675b894c0ea19c46a160204a615ece707636eecf5e943e7dd13a80313a2ef622c7e324d342824350ae9cc19d75
SSDEEP

6144:nhWxjk0EdatAbulIY24k43n6fJRM2jmQdG6:nOjk0gatIW0NmQdN

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

23c649ba9aec2c9778a6bd25081771cff40805934b95b9bcbea838fde106b251.exe

description	pid	process	target process
PID 5056 set thread context of 3960	5056	23c649ba9aec2c9778a6bd25081771cff40805934b95b9bcbea838fde106b251.exe	23c649ba9aec2c9778a6bd25081771cff40805934b95b9bcbea838fde106b251.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
4568	5056	WerFault.exe	23c649ba9aec2c9778a6bd25081771cff40805934b95b9bcbea838fde106b251.exe
3172	5056	WerFault.exe	23c649ba9aec2c9778a6bd25081771cff40805934b95b9bcbea838fde106b251.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

23c649ba9aec2c9778a6bd25081771cff40805934b95b9bcbea838fde106b251.exe

description	pid	process	target process
PID 5056 wrote to memory of 3960	5056	23c649ba9aec2c9778a6bd25081771cff40805934b95b9bcbea838fde106b251.exe	23c649ba9aec2c9778a6bd25081771cff40805934b95b9bcbea838fde106b251.exe
PID 5056 wrote to memory of 3960	5056	23c649ba9aec2c9778a6bd25081771cff40805934b95b9bcbea838fde106b251.exe	23c649ba9aec2c9778a6bd25081771cff40805934b95b9bcbea838fde106b251.exe
PID 5056 wrote to memory of 3960	5056	23c649ba9aec2c9778a6bd25081771cff40805934b95b9bcbea838fde106b251.exe	23c649ba9aec2c9778a6bd25081771cff40805934b95b9bcbea838fde106b251.exe
PID 5056 wrote to memory of 3960	5056	23c649ba9aec2c9778a6bd25081771cff40805934b95b9bcbea838fde106b251.exe	23c649ba9aec2c9778a6bd25081771cff40805934b95b9bcbea838fde106b251.exe
PID 5056 wrote to memory of 3960	5056	23c649ba9aec2c9778a6bd25081771cff40805934b95b9bcbea838fde106b251.exe	23c649ba9aec2c9778a6bd25081771cff40805934b95b9bcbea838fde106b251.exe
PID 5056 wrote to memory of 3960	5056	23c649ba9aec2c9778a6bd25081771cff40805934b95b9bcbea838fde106b251.exe	23c649ba9aec2c9778a6bd25081771cff40805934b95b9bcbea838fde106b251.exe
PID 5056 wrote to memory of 3960	5056	23c649ba9aec2c9778a6bd25081771cff40805934b95b9bcbea838fde106b251.exe	23c649ba9aec2c9778a6bd25081771cff40805934b95b9bcbea838fde106b251.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 376
2⤵
- Program crash
PID:4568

C:\Users\Admin\AppData\Local\Temp\23c649ba9aec2c9778a6bd25081771cff40805934b95b9bcbea838fde106b251.exe
"C:\Users\Admin\AppData\Local\Temp\23c649ba9aec2c9778a6bd25081771cff40805934b95b9bcbea838fde106b251.exe"
2⤵
PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 140
2⤵
- Program crash
PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5056 -ip 5056
1⤵
PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5056 -ip 5056
1⤵
PID:4580

memory/3960-132-0x0000000000000000-mapping.dmp

Download
memory/3960-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3960-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3960-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3960-137-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3960-138-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download