e8cd8defc178370a4cbe8960dc60d6a847714f10bef8ac48bcb710a8bffbd096

Analysis

max time kernel
196s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 09:38

Target

e8cd8defc178370a4cbe8960dc60d6a847714f10bef8ac48bcb710a8bffbd096.exe
Size

37KB
MD5

1ae54e427e271927f753f1dd52734f50
SHA1

49ca7cd3f2a86e6666b48df1161d81263bc749aa
SHA256

e8cd8defc178370a4cbe8960dc60d6a847714f10bef8ac48bcb710a8bffbd096
SHA512

945f143163b58df98cd19bc4b6362fe6029bf90bf2fad88785c3771ce43367e60124f2f439f7d57c2ebec36d082cebe2cc07ea367f6ef73216550296e7634576
SSDEEP

768:P3amUkTe2uVf8VPZUpRwqK8RPRDUVojyH6ERXXpQRWzee6qg6i2essYmwvV8nLrD:fa9iexVfeva6ojyHFRXXpQRWzee6v9Ya

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1848	lqrjma.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\lqrjma.exe	e8cd8defc178370a4cbe8960dc60d6a847714f10bef8ac48bcb710a8bffbd096.exe
File opened for modification	C:\Windows\SysWOW64\lqrjma.exe	e8cd8defc178370a4cbe8960dc60d6a847714f10bef8ac48bcb710a8bffbd096.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1848 set thread context of 1768	1848	lqrjma.exe	80

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1924	1768	WerFault.exe	80

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1696	e8cd8defc178370a4cbe8960dc60d6a847714f10bef8ac48bcb710a8bffbd096.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 1768	1848	lqrjma.exe	80
PID 1848 wrote to memory of 1768	1848	lqrjma.exe	80
PID 1848 wrote to memory of 1768	1848	lqrjma.exe	80
PID 1848 wrote to memory of 1768	1848	lqrjma.exe	80
PID 1848 wrote to memory of 1768	1848	lqrjma.exe	80

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1768 -ip 1768
1⤵
PID:3428

C:\Windows\SysWOW64\lqrjma.exe

Filesize
37KB

MD5
1ae54e427e271927f753f1dd52734f50

SHA1
49ca7cd3f2a86e6666b48df1161d81263bc749aa

SHA256
e8cd8defc178370a4cbe8960dc60d6a847714f10bef8ac48bcb710a8bffbd096

SHA512
945f143163b58df98cd19bc4b6362fe6029bf90bf2fad88785c3771ce43367e60124f2f439f7d57c2ebec36d082cebe2cc07ea367f6ef73216550296e7634576

Download Submit
C:\Windows\SysWOW64\lqrjma.exe

Filesize
37KB

MD5
1ae54e427e271927f753f1dd52734f50

SHA1
49ca7cd3f2a86e6666b48df1161d81263bc749aa

SHA256
e8cd8defc178370a4cbe8960dc60d6a847714f10bef8ac48bcb710a8bffbd096

SHA512
945f143163b58df98cd19bc4b6362fe6029bf90bf2fad88785c3771ce43367e60124f2f439f7d57c2ebec36d082cebe2cc07ea367f6ef73216550296e7634576

Download Submit
memory/1768-135-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download