c7715cabaa44e33a7e60bc3599924d77e0021383d2f6b1b0ecd5e84bcbfb62c2

Analysis

max time kernel
301s
max time network
370s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 07:48

Target

c7715cabaa44e33a7e60bc3599924d77e0021383d2f6b1b0ecd5e84bcbfb62c2.exe
Size

478KB
MD5

e46421290522060e95dc6c6ac9bab9c8
SHA1

08aaa1203dca088e366ea31253ec264ca710f015
SHA256

c7715cabaa44e33a7e60bc3599924d77e0021383d2f6b1b0ecd5e84bcbfb62c2
SHA512

d590f467b8ebcc8805d910506585033c29c6f3f47b232cf2ebbfea91bf139e135b197ecd8a599521b25cf45fa0e46932e992842651ffe4d0c71b9c2d866369a5
SSDEEP

6144:/ipL4qsxpzEeqcQL3dOk+yrctZl/nS0JSAS2cu1PfFjHNNj9iL:/6UZbzH2Ok+HbrJSycwl/j90

Score

5^/10

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2364	c7715cabaa44e33a7e60bc3599924d77e0021383d2f6b1b0ecd5e84bcbfb62c2.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2364 set thread context of 4680	2364	c7715cabaa44e33a7e60bc3599924d77e0021383d2f6b1b0ecd5e84bcbfb62c2.exe	80

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3080	4680	WerFault.exe	80

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2364	c7715cabaa44e33a7e60bc3599924d77e0021383d2f6b1b0ecd5e84bcbfb62c2.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 4680	2364	c7715cabaa44e33a7e60bc3599924d77e0021383d2f6b1b0ecd5e84bcbfb62c2.exe	80
PID 2364 wrote to memory of 4680	2364	c7715cabaa44e33a7e60bc3599924d77e0021383d2f6b1b0ecd5e84bcbfb62c2.exe	80
PID 2364 wrote to memory of 4680	2364	c7715cabaa44e33a7e60bc3599924d77e0021383d2f6b1b0ecd5e84bcbfb62c2.exe	80
PID 2364 wrote to memory of 4680	2364	c7715cabaa44e33a7e60bc3599924d77e0021383d2f6b1b0ecd5e84bcbfb62c2.exe	80
PID 2364 wrote to memory of 4680	2364	c7715cabaa44e33a7e60bc3599924d77e0021383d2f6b1b0ecd5e84bcbfb62c2.exe	80
PID 2364 wrote to memory of 4680	2364	c7715cabaa44e33a7e60bc3599924d77e0021383d2f6b1b0ecd5e84bcbfb62c2.exe	80
PID 2364 wrote to memory of 4680	2364	c7715cabaa44e33a7e60bc3599924d77e0021383d2f6b1b0ecd5e84bcbfb62c2.exe	80
PID 2364 wrote to memory of 4680	2364	c7715cabaa44e33a7e60bc3599924d77e0021383d2f6b1b0ecd5e84bcbfb62c2.exe	80
PID 2364 wrote to memory of 4680	2364	c7715cabaa44e33a7e60bc3599924d77e0021383d2f6b1b0ecd5e84bcbfb62c2.exe	80
PID 2364 wrote to memory of 4680	2364	c7715cabaa44e33a7e60bc3599924d77e0021383d2f6b1b0ecd5e84bcbfb62c2.exe	80

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4680 -ip 4680
1⤵
PID:4092