e26bd11c525dfca4152ed74b2fb97e5c30a091239c2dbe877a312a1cfcf34004

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 16:22

Target

e26bd11c525dfca4152ed74b2fb97e5c30a091239c2dbe877a312a1cfcf34004.exe
Size

820KB
MD5

53efb689f9f56262b571f68b11a21839
SHA1

0d31c13c910cbb2dd2979a3762a9223aa12eceee
SHA256

e26bd11c525dfca4152ed74b2fb97e5c30a091239c2dbe877a312a1cfcf34004
SHA512

f7c2723cee0b9d8db1f910e852d4e66f2a10de0710a106676b4f1a07cd6e8e49987d1cac9b30007014f9f8e108d0baccdbca2b7ce4ff863a09570851b9cbf43b
SSDEEP

24576:0tkyyQSspmUheMMyo+g7d9TEE4Zm36B5qbN8:0vSspFeMMDbd1F6BY

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

e26bd11c525dfca4152ed74b2fb97e5c30a091239c2dbe877a312a1cfcf34004.exe

description	pid	process	target process
PID 4264 set thread context of 1944	4264	e26bd11c525dfca4152ed74b2fb97e5c30a091239c2dbe877a312a1cfcf34004.exe	e26bd11c525dfca4152ed74b2fb97e5c30a091239c2dbe877a312a1cfcf34004.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2160 1944 WerFault.exe e26bd11c525dfca4152ed74b2fb97e5c30a091239c2dbe877a312a1cfcf34004.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

e26bd11c525dfca4152ed74b2fb97e5c30a091239c2dbe877a312a1cfcf34004.exe

pid process

1944 e26bd11c525dfca4152ed74b2fb97e5c30a091239c2dbe877a312a1cfcf34004.exe

pid	pid_target	process	target process
2160	1944	WerFault.exe	e26bd11c525dfca4152ed74b2fb97e5c30a091239c2dbe877a312a1cfcf34004.exe

pid	process
1944	e26bd11c525dfca4152ed74b2fb97e5c30a091239c2dbe877a312a1cfcf34004.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

e26bd11c525dfca4152ed74b2fb97e5c30a091239c2dbe877a312a1cfcf34004.exe

description	pid	process	target process
PID 4264 wrote to memory of 1944	4264	e26bd11c525dfca4152ed74b2fb97e5c30a091239c2dbe877a312a1cfcf34004.exe	e26bd11c525dfca4152ed74b2fb97e5c30a091239c2dbe877a312a1cfcf34004.exe
PID 4264 wrote to memory of 1944	4264	e26bd11c525dfca4152ed74b2fb97e5c30a091239c2dbe877a312a1cfcf34004.exe	e26bd11c525dfca4152ed74b2fb97e5c30a091239c2dbe877a312a1cfcf34004.exe
PID 4264 wrote to memory of 1944	4264	e26bd11c525dfca4152ed74b2fb97e5c30a091239c2dbe877a312a1cfcf34004.exe	e26bd11c525dfca4152ed74b2fb97e5c30a091239c2dbe877a312a1cfcf34004.exe
PID 4264 wrote to memory of 1944	4264	e26bd11c525dfca4152ed74b2fb97e5c30a091239c2dbe877a312a1cfcf34004.exe	e26bd11c525dfca4152ed74b2fb97e5c30a091239c2dbe877a312a1cfcf34004.exe
PID 4264 wrote to memory of 1944	4264	e26bd11c525dfca4152ed74b2fb97e5c30a091239c2dbe877a312a1cfcf34004.exe	e26bd11c525dfca4152ed74b2fb97e5c30a091239c2dbe877a312a1cfcf34004.exe
PID 4264 wrote to memory of 1944	4264	e26bd11c525dfca4152ed74b2fb97e5c30a091239c2dbe877a312a1cfcf34004.exe	e26bd11c525dfca4152ed74b2fb97e5c30a091239c2dbe877a312a1cfcf34004.exe
PID 4264 wrote to memory of 1944	4264	e26bd11c525dfca4152ed74b2fb97e5c30a091239c2dbe877a312a1cfcf34004.exe	e26bd11c525dfca4152ed74b2fb97e5c30a091239c2dbe877a312a1cfcf34004.exe

C:\Users\Admin\AppData\Local\Temp\e26bd11c525dfca4152ed74b2fb97e5c30a091239c2dbe877a312a1cfcf34004.exe
"C:\Users\Admin\AppData\Local\Temp\e26bd11c525dfca4152ed74b2fb97e5c30a091239c2dbe877a312a1cfcf34004.exe"
2⤵
- Suspicious use of UnmapMainImage
PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 12
3⤵
- Program crash
PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1944 -ip 1944
1⤵
PID:3108

memory/1944-133-0x0000000000000000-mapping.dmp

Download
memory/1944-134-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/4264-132-0x0000000074F40000-0x00000000754F1000-memory.dmp

Filesize
5.7MB

Download
memory/4264-135-0x0000000074F40000-0x00000000754F1000-memory.dmp

Filesize
5.7MB

Download