730da98929244c496f022b6275228a19f3621653a1158ef5a4f3b9f0def255a9

Analysis

max time kernel
138s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 13:40

Target

730da98929244c496f022b6275228a19f3621653a1158ef5a4f3b9f0def255a9.exe
Size

86KB
MD5

2a6af37889d06ebd1c8f2d93e11cc3f0
SHA1

4df33c875bf15aa24011f7c5f0a35afa848ede40
SHA256

730da98929244c496f022b6275228a19f3621653a1158ef5a4f3b9f0def255a9
SHA512

d581b89dc4e7198d7d4da1f5f0cf263d6d73e53bb0cd725ae63c69e213a9175f5971230328a28b3bcbb16a3de33586b1e902d7ab49283680a0148b3ef1280790
SSDEEP

1536:/3gSibPXmzXm1jYjqIBlvAtkRszLVqonxeiIjrkFjMZVzTe:9CvKXojYjflI+1oSejMjzT

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

730da98929244c496f022b6275228a19f3621653a1158ef5a4f3b9f0def255a9.exe

description	pid	process	target process
PID 3268 set thread context of 4936	3268	730da98929244c496f022b6275228a19f3621653a1158ef5a4f3b9f0def255a9.exe	730da98929244c496f022b6275228a19f3621653a1158ef5a4f3b9f0def255a9.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4204 3268 WerFault.exe 730da98929244c496f022b6275228a19f3621653a1158ef5a4f3b9f0def255a9.exe

pid	pid_target	process	target process
4204	3268	WerFault.exe	730da98929244c496f022b6275228a19f3621653a1158ef5a4f3b9f0def255a9.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

730da98929244c496f022b6275228a19f3621653a1158ef5a4f3b9f0def255a9.exe

description	pid	process	target process
PID 3268 wrote to memory of 4936	3268	730da98929244c496f022b6275228a19f3621653a1158ef5a4f3b9f0def255a9.exe	730da98929244c496f022b6275228a19f3621653a1158ef5a4f3b9f0def255a9.exe
PID 3268 wrote to memory of 4936	3268	730da98929244c496f022b6275228a19f3621653a1158ef5a4f3b9f0def255a9.exe	730da98929244c496f022b6275228a19f3621653a1158ef5a4f3b9f0def255a9.exe
PID 3268 wrote to memory of 4936	3268	730da98929244c496f022b6275228a19f3621653a1158ef5a4f3b9f0def255a9.exe	730da98929244c496f022b6275228a19f3621653a1158ef5a4f3b9f0def255a9.exe
PID 3268 wrote to memory of 4936	3268	730da98929244c496f022b6275228a19f3621653a1158ef5a4f3b9f0def255a9.exe	730da98929244c496f022b6275228a19f3621653a1158ef5a4f3b9f0def255a9.exe

C:\Users\Admin\AppData\Local\Temp\730da98929244c496f022b6275228a19f3621653a1158ef5a4f3b9f0def255a9.exe
"C:\Users\Admin\AppData\Local\Temp\730da98929244c496f022b6275228a19f3621653a1158ef5a4f3b9f0def255a9.exe"
2⤵
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3268 -s 292
2⤵
- Program crash
PID:4204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3268 -ip 3268
1⤵
PID:3928