9cd5fd7525762e0a5eb745659a1f3559df236334ee82dd0bd79ced7b1e87b6fd

Analysis

max time kernel
105s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 20:32

Target

9cd5fd7525762e0a5eb745659a1f3559df236334ee82dd0bd79ced7b1e87b6fd.exe
Size

289KB
MD5

f0e641c7a4c0776ba1924e282b63e2f2
SHA1

7b25dc7e864594cc64cc185a51ae61cc6430a22b
SHA256

9cd5fd7525762e0a5eb745659a1f3559df236334ee82dd0bd79ced7b1e87b6fd
SHA512

e2451b41fff455f2d8c7cde6790c1043101fe61f202d5490e91662d5a9a78f874903c83d6fab110321db2639d315c3ad735c2fb1276b956ff4bcd2e50fdd52d5
SSDEEP

6144:3cIC75yWIT8ucQAFdEOqo7kJcKUO7qtDDboJdchbSTe/Tw:cyW7pQKnnGJ68JdchbS6rw

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2532 set thread context of 1668	2532	9cd5fd7525762e0a5eb745659a1f3559df236334ee82dd0bd79ced7b1e87b6fd.exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1972	1668	WerFault.exe	82

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1668	2532	9cd5fd7525762e0a5eb745659a1f3559df236334ee82dd0bd79ced7b1e87b6fd.exe	82
PID 2532 wrote to memory of 1668	2532	9cd5fd7525762e0a5eb745659a1f3559df236334ee82dd0bd79ced7b1e87b6fd.exe	82
PID 2532 wrote to memory of 1668	2532	9cd5fd7525762e0a5eb745659a1f3559df236334ee82dd0bd79ced7b1e87b6fd.exe	82
PID 2532 wrote to memory of 1668	2532	9cd5fd7525762e0a5eb745659a1f3559df236334ee82dd0bd79ced7b1e87b6fd.exe	82
PID 2532 wrote to memory of 1668	2532	9cd5fd7525762e0a5eb745659a1f3559df236334ee82dd0bd79ced7b1e87b6fd.exe	82
PID 2532 wrote to memory of 1668	2532	9cd5fd7525762e0a5eb745659a1f3559df236334ee82dd0bd79ced7b1e87b6fd.exe	82
PID 2532 wrote to memory of 1668	2532	9cd5fd7525762e0a5eb745659a1f3559df236334ee82dd0bd79ced7b1e87b6fd.exe	82
PID 2532 wrote to memory of 1668	2532	9cd5fd7525762e0a5eb745659a1f3559df236334ee82dd0bd79ced7b1e87b6fd.exe	82

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1668 -ip 1668
1⤵
PID:4380

memory/1668-133-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1668-135-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1668-136-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1668-137-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download