9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed

Analysis

max time kernel
195s
max time network
219s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 23:52

Target

9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe
Size

61KB
MD5

d017cbc39ba2ce43c9dba5640f1e20ba
SHA1

e6c069f31a7d169525cb8ba6d4f0ca7ac48ce4c5
SHA256

9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed
SHA512

d66f08bfbaa6bf813eb8a6e9a8237e09ec74529ad5d9fb2e7d5c6bee078544ca29b4f5366772a1f8bf14024c78587f65b951371750660efe0f32d2f6ce108dcf
SSDEEP

768:/x+hcXiL6ys843c0p9+0eLQilUGKn2oAq/QQ50G+7kUOM+suupICPIztzK:/xscXuk/Mq9+hLQuK2lq//EOszpwG

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4916 set thread context of 3376	4916	9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe	81

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4548	4916	WerFault.exe	79

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4916	9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 3376	4916	9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe	81
PID 4916 wrote to memory of 3376	4916	9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe	81
PID 4916 wrote to memory of 3376	4916	9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe	81
PID 4916 wrote to memory of 3376	4916	9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe	81
PID 4916 wrote to memory of 3376	4916	9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe	81
PID 4916 wrote to memory of 3376	4916	9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe	81
PID 4916 wrote to memory of 3376	4916	9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe	81

C:\Users\Admin\AppData\Local\Temp\9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe
"C:\Users\Admin\AppData\Local\Temp\9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Users\Admin\AppData\Local\Temp\9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe
  C:\Users\Admin\AppData\Local\Temp\9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe
  2⤵
  PID:3376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 480
  2⤵
  - Program crash
  PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4916 -ip 4916
1⤵
PID:4372

memory/3376-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3376-140-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3376-141-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4916-139-0x0000000000400000-0x0000000000409001-memory.dmp

Filesize
36KB

Download