897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 06:00

Target

897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe
Size

45KB
MD5

bf83f96bd78a43fa3abc36ab55d61b5f
SHA1

3468945288128014b236b47fd55f35757688eaa3
SHA256

897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979
SHA512

bcad6f9ae4c1facb02f5c33399e27427d4834d5cc0266e9fc540b11fcfb6ce945a4a194c0488b33914447ed1a4fe32cca08b2bf7971e50c7147bdc1bc4195bff
SSDEEP

768:hCCqjLQSY6Hna6pVA4jOOMOcokE9CZDkYneJldC9cIheVI6kcsIB:ICq/Q5ma4wLOcokqwkgeLdCi2eV0I

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe

description	pid	process	target process
PID 3376 set thread context of 1388	3376	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
4368	3376	WerFault.exe	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe
3620	1388	WerFault.exe	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe

description	pid	process	target process
PID 3376 wrote to memory of 1388	3376	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe
PID 3376 wrote to memory of 1388	3376	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe
PID 3376 wrote to memory of 1388	3376	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe
PID 3376 wrote to memory of 1388	3376	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe
PID 3376 wrote to memory of 1388	3376	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe	897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe

C:\Users\Admin\AppData\Local\Temp\897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe
"C:\Users\Admin\AppData\Local\Temp\897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Users\Admin\AppData\Local\Temp\897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe
  C:\Users\Admin\AppData\Local\Temp\897f48e0b55581fb988a79e9426f793cc743b39b614b4d125699b885b6569979.exe
  2⤵
  PID:1388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 208
    3⤵
    - Program crash
    PID:3620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 300
  2⤵
  - Program crash
  PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3376 -ip 3376
1⤵
PID:1588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1388 -ip 1388
1⤵
PID:2668

memory/1388-132-0x0000000000000000-mapping.dmp

Download
memory/1388-133-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1388-135-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1388-136-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download