74d488cf8f38f83ca6c65012ded439e1482006eb7e3314033026f2427167d7ba

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 03:11

Target

74d488cf8f38f83ca6c65012ded439e1482006eb7e3314033026f2427167d7ba.exe
Size

1016KB
MD5

972bfa34d2f41eb2b43b678a443fceea
SHA1

8efce435b908c30ae50bb4320897973ededb4dc3
SHA256

74d488cf8f38f83ca6c65012ded439e1482006eb7e3314033026f2427167d7ba
SHA512

bd6b7b5bdaae23c64d1a3de165c0e6e092446652e17e929e10369e0f51f841b88e94cd6f892eb7e2faeb00d56232573f3c8d30d9f0e5b5d63ab43bc41fe5df2f
SSDEEP

24576:WJphKT5g6i1ltObHArBkccE9jO4o1H6DUe4e33l:+phA5gZ1llSccE9jOFH6DUhen

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1400 set thread context of 3448	1400	74d488cf8f38f83ca6c65012ded439e1482006eb7e3314033026f2427167d7ba.exe	80

Program crash 1 IoCs

pid	pid_target	Process	procid_target
532	3448	WerFault.exe	80

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 3448	1400	74d488cf8f38f83ca6c65012ded439e1482006eb7e3314033026f2427167d7ba.exe	80
PID 1400 wrote to memory of 3448	1400	74d488cf8f38f83ca6c65012ded439e1482006eb7e3314033026f2427167d7ba.exe	80
PID 1400 wrote to memory of 3448	1400	74d488cf8f38f83ca6c65012ded439e1482006eb7e3314033026f2427167d7ba.exe	80
PID 1400 wrote to memory of 3448	1400	74d488cf8f38f83ca6c65012ded439e1482006eb7e3314033026f2427167d7ba.exe	80

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3448 -ip 3448
1⤵
PID:2264

memory/1400-132-0x0000000074F40000-0x00000000754F1000-memory.dmp

Filesize
5.7MB

Download
memory/1400-134-0x0000000074F40000-0x00000000754F1000-memory.dmp

Filesize
5.7MB

Download