b4911217679701fd9f307170d4ce81a70467aa27126316644e202bd20d547551

Analysis

max time kernel
157s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 15:04

Target

b4911217679701fd9f307170d4ce81a70467aa27126316644e202bd20d547551.exe
Size

261KB
MD5

abf33ab05d3f2b8c19018364def0861b
SHA1

50b043c9ba3fa99ac3e968e2deedbd5323f21eff
SHA256

b4911217679701fd9f307170d4ce81a70467aa27126316644e202bd20d547551
SHA512

f0709f0dd6bdd5813a0a684ac603cecdb9e43614608d8b09450365c5b7d7176b5e440142d2e5e5806ab28e92f65e57f982589365b2780b5fe2742bb89c0cde1a
SSDEEP

6144:MO8Ix8uaN7WmevRgAwlZpcz0t2YVFV+vTzs+OO2Mm:MO8I8WmevYo3YVz+vXsLO2/

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

b4911217679701fd9f307170d4ce81a70467aa27126316644e202bd20d547551.exe

description	pid	process	target process
PID 1792 set thread context of 4652	1792	b4911217679701fd9f307170d4ce81a70467aa27126316644e202bd20d547551.exe	notepad.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1444 4652 WerFault.exe notepad.exe

pid	pid_target	process	target process
1444	4652	WerFault.exe	notepad.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

b4911217679701fd9f307170d4ce81a70467aa27126316644e202bd20d547551.exe

description	pid	process	target process
PID 1792 wrote to memory of 4652	1792	b4911217679701fd9f307170d4ce81a70467aa27126316644e202bd20d547551.exe	notepad.exe
PID 1792 wrote to memory of 4652	1792	b4911217679701fd9f307170d4ce81a70467aa27126316644e202bd20d547551.exe	notepad.exe
PID 1792 wrote to memory of 4652	1792	b4911217679701fd9f307170d4ce81a70467aa27126316644e202bd20d547551.exe	notepad.exe
PID 1792 wrote to memory of 4652	1792	b4911217679701fd9f307170d4ce81a70467aa27126316644e202bd20d547551.exe	notepad.exe
PID 1792 wrote to memory of 4652	1792	b4911217679701fd9f307170d4ce81a70467aa27126316644e202bd20d547551.exe	notepad.exe
PID 1792 wrote to memory of 4652	1792	b4911217679701fd9f307170d4ce81a70467aa27126316644e202bd20d547551.exe	notepad.exe
PID 1792 wrote to memory of 4652	1792	b4911217679701fd9f307170d4ce81a70467aa27126316644e202bd20d547551.exe	notepad.exe
PID 1792 wrote to memory of 4652	1792	b4911217679701fd9f307170d4ce81a70467aa27126316644e202bd20d547551.exe	notepad.exe
PID 1792 wrote to memory of 4652	1792	b4911217679701fd9f307170d4ce81a70467aa27126316644e202bd20d547551.exe	notepad.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 184
3⤵
- Program crash
PID:1444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4652 -ip 4652
1⤵
PID:3436

memory/1792-132-0x0000000074FF0000-0x00000000755A1000-memory.dmp

Filesize
5.7MB

Download
memory/1792-144-0x0000000074FF0000-0x00000000755A1000-memory.dmp

Filesize
5.7MB

Download
memory/4652-135-0x0000000000660000-0x0000000000686000-memory.dmp

Filesize
152KB

Download
memory/4652-133-0x0000000000000000-mapping.dmp

Download
memory/4652-139-0x0000000000660000-0x0000000000686000-memory.dmp

Filesize
152KB

Download
memory/4652-143-0x0000000000660000-0x0000000000686000-memory.dmp

Filesize
152KB

Download