7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd

Analysis

max time kernel
184s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 22:50

Target

7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe
Size

221KB
MD5

3081241a661c2affbbc9464189c4126c
SHA1

a0ab4b4b65709bb5088822af9261659fb3c8e7af
SHA256

7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd
SHA512

c125c0b77eb13e58fdbbf548032cb58527227d4b590fe5eda64ef3182b88b9b979b874544587852f9696da789e1015aa765ef7603307856befd78f720ea54031
SSDEEP

3072:1OwZr1Z1iYoQ0rBY1HARieUNAXQNMCGg85S8rXRziTe9VBhpAelSFmE3w8PVju96:1HiygRieqzGNuTYBhpAemmnwjumjp

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
2268	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1256 set thread context of 2268	1256	7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4984	2268	WerFault.exe	82

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 2268	1256	7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe	82
PID 1256 wrote to memory of 2268	1256	7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe	82
PID 1256 wrote to memory of 2268	1256	7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe	82
PID 1256 wrote to memory of 2268	1256	7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe	82
PID 1256 wrote to memory of 2268	1256	7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe	82
PID 1256 wrote to memory of 2268	1256	7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe	82
PID 1256 wrote to memory of 2268	1256	7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe	82
PID 1256 wrote to memory of 2268	1256	7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe	82
PID 1256 wrote to memory of 2268	1256	7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe	82
PID 1256 wrote to memory of 2268	1256	7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe	82
PID 1256 wrote to memory of 2268	1256	7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe	82
PID 1256 wrote to memory of 2268	1256	7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe	82
PID 1256 wrote to memory of 2268	1256	7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe	82

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2268 -ip 2268
1⤵
PID:3536

C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
memory/1256-132-0x0000000074A60000-0x0000000075011000-memory.dmp

Filesize
5.7MB

Download
memory/1256-136-0x0000000074A60000-0x0000000075011000-memory.dmp

Filesize
5.7MB

Download
memory/2268-133-0x0000000000000000-mapping.dmp

Download
memory/2268-134-0x0000000011490000-0x00000000114B8000-memory.dmp

Filesize
160KB

Download