6ed16a56d6f3b430229c64b44d83fbae8e53b0f0053b0a60d2f34f90663b5cfa

Analysis

max time kernel
152s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 22:10

Target

6ed16a56d6f3b430229c64b44d83fbae8e53b0f0053b0a60d2f34f90663b5cfa.exe
Size

56KB
MD5

e4771d806c4d77a607363f29882a6e60
SHA1

91f80b857d904ae7b38d475477f3558f445f30e9
SHA256

6ed16a56d6f3b430229c64b44d83fbae8e53b0f0053b0a60d2f34f90663b5cfa
SHA512

f4a152f8e76b23b139939d827404b7ab0f8fc0705a82eca26f440c7d10e7765b857fd2cc38729d8e94607bcb41ad3eb949e0bcff8114f027d76195503b0966c0
SSDEEP

1536:fSdlUIMBqUTXT+PcdDUycafTCejGX74CuyMm6DDS:6dNMBDP+0dZTCejGHuy0fS

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

6ed16a56d6f3b430229c64b44d83fbae8e53b0f0053b0a60d2f34f90663b5cfa.exe

description	pid	process	target process
PID 1344 set thread context of 832	1344	6ed16a56d6f3b430229c64b44d83fbae8e53b0f0053b0a60d2f34f90663b5cfa.exe	6ed16a56d6f3b430229c64b44d83fbae8e53b0f0053b0a60d2f34f90663b5cfa.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

176 832 WerFault.exe 6ed16a56d6f3b430229c64b44d83fbae8e53b0f0053b0a60d2f34f90663b5cfa.exe

pid	pid_target	process	target process
176	832	WerFault.exe	6ed16a56d6f3b430229c64b44d83fbae8e53b0f0053b0a60d2f34f90663b5cfa.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

6ed16a56d6f3b430229c64b44d83fbae8e53b0f0053b0a60d2f34f90663b5cfa.exe

description	pid	process	target process
PID 1344 wrote to memory of 832	1344	6ed16a56d6f3b430229c64b44d83fbae8e53b0f0053b0a60d2f34f90663b5cfa.exe	6ed16a56d6f3b430229c64b44d83fbae8e53b0f0053b0a60d2f34f90663b5cfa.exe
PID 1344 wrote to memory of 832	1344	6ed16a56d6f3b430229c64b44d83fbae8e53b0f0053b0a60d2f34f90663b5cfa.exe	6ed16a56d6f3b430229c64b44d83fbae8e53b0f0053b0a60d2f34f90663b5cfa.exe
PID 1344 wrote to memory of 832	1344	6ed16a56d6f3b430229c64b44d83fbae8e53b0f0053b0a60d2f34f90663b5cfa.exe	6ed16a56d6f3b430229c64b44d83fbae8e53b0f0053b0a60d2f34f90663b5cfa.exe

C:\Users\Admin\AppData\Local\Temp\6ed16a56d6f3b430229c64b44d83fbae8e53b0f0053b0a60d2f34f90663b5cfa.exe
"C:\Users\Admin\AppData\Local\Temp\6ed16a56d6f3b430229c64b44d83fbae8e53b0f0053b0a60d2f34f90663b5cfa.exe"
2⤵
PID:832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 832 -s 12
3⤵
- Program crash
PID:176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 832 -ip 832
1⤵
PID:4764