5c2df2368e1df791babcfb369a6d937f84eba233bfdef1f3f734ed33776b76bd

Analysis

max time kernel
180s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 14:16

Target

5c2df2368e1df791babcfb369a6d937f84eba233bfdef1f3f734ed33776b76bd.exe
Size

341KB
MD5

1066b8abff64b15d9cd04c5018897f91
SHA1

bfbbff0e058d082043cdebedfaaf4347a8135eea
SHA256

5c2df2368e1df791babcfb369a6d937f84eba233bfdef1f3f734ed33776b76bd
SHA512

7dab10f1d2fbc54e0e70f53ba1b97c2695669b1ddfbb4c33dab0434c40c1aae96c0504a69d1067fe6b2f5ef63954683ea6637f7b661f93d506ed064425ffe218
SSDEEP

6144:yhzlNP6Zy1waiKgY8rLrKJFzX7WBjrYyDWHWccGeXGbUFqdzbCfJ:yhTPoaiK5AgZAwtHZ1ccHCfJ

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4784 set thread context of 1312	4784	5c2df2368e1df791babcfb369a6d937f84eba233bfdef1f3f734ed33776b76bd.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 1312	4784	5c2df2368e1df791babcfb369a6d937f84eba233bfdef1f3f734ed33776b76bd.exe	83
PID 4784 wrote to memory of 1312	4784	5c2df2368e1df791babcfb369a6d937f84eba233bfdef1f3f734ed33776b76bd.exe	83
PID 4784 wrote to memory of 1312	4784	5c2df2368e1df791babcfb369a6d937f84eba233bfdef1f3f734ed33776b76bd.exe	83

C:\Users\Admin\AppData\Local\Temp\5c2df2368e1df791babcfb369a6d937f84eba233bfdef1f3f734ed33776b76bd.exe
"C:\Users\Admin\AppData\Local\Temp\5c2df2368e1df791babcfb369a6d937f84eba233bfdef1f3f734ed33776b76bd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Users\Admin\AppData\Local\Temp\5c2df2368e1df791babcfb369a6d937f84eba233bfdef1f3f734ed33776b76bd.exe
  "C:\Users\Admin\AppData\Local\Temp\5c2df2368e1df791babcfb369a6d937f84eba233bfdef1f3f734ed33776b76bd.exe"
  2⤵
  PID:1312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1312 -ip 1312
1⤵
PID:112