4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 04:40

Target

4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628.exe
Size

68KB
MD5

fbf7e4c4537cb3979c87972a851ee4d3
SHA1

3124690749b240120ac11d8b1e1857194df9c2b4
SHA256

4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628
SHA512

72c44384dda4bd4d902584550e2b67cd63bb9c118b721722ed140d053c8d3910862ea493599d53be4f6fe3ccf9c758b6bb5d09fb61a410b38782081f029915e9
SSDEEP

1536:KzbzEaehTMBLIeBa3n5ReL8biW8AL+7GQkp1g:KzPohYBLIz5eWbL4I1g

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2080	4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4644 set thread context of 2080	4644	4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628.exe	79

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3060	2080	WerFault.exe	79

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 2080	4644	4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628.exe	79
PID 4644 wrote to memory of 2080	4644	4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628.exe	79
PID 4644 wrote to memory of 2080	4644	4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628.exe	79
PID 4644 wrote to memory of 2080	4644	4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628.exe	79
PID 4644 wrote to memory of 2080	4644	4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628.exe	79
PID 4644 wrote to memory of 2080	4644	4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628.exe	79
PID 4644 wrote to memory of 2080	4644	4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628.exe	79
PID 4644 wrote to memory of 2080	4644	4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628.exe	79
PID 4644 wrote to memory of 2080	4644	4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628.exe	79

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2080 -ip 2080
1⤵
PID:4620

memory/2080-133-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2080-136-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2080-137-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2080-138-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2080-139-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4644-134-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download