988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7

Analysis

max time kernel
149s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 16:38

Target

988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7.exe
Size

56KB
MD5

c6433cdf79a2b573d05649c861fdce73
SHA1

a644b70df44addbc97af3ff508b197b1f2485445
SHA256

988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7
SHA512

0588890febbcf6ce1baee19ae272ce50aa6e2359dc04def5a4ba100de8f0d2bbbaf58528fce38eb81828ac064c94b7ff798cf13f3033d6cb95a45b03bd416785
SSDEEP

768:y+JS71pvXry+vvYgDGoB+Uu0jCJDKV72pa1BLcceUCSSDaXdF+lF7P7J5reaCn+v:poD2aYWvl7v3ccepSY+A37feaCMJDmS

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1660 set thread context of 208	1660	988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1100	208	WerFault.exe	83

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
208	988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 208	1660	988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7.exe	83
PID 1660 wrote to memory of 208	1660	988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7.exe	83
PID 1660 wrote to memory of 208	1660	988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7.exe	83
PID 1660 wrote to memory of 208	1660	988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7.exe	83
PID 1660 wrote to memory of 208	1660	988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7.exe	83
PID 1660 wrote to memory of 208	1660	988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7.exe	83
PID 1660 wrote to memory of 208	1660	988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7.exe	83
PID 1660 wrote to memory of 208	1660	988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7.exe	83

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 208 -ip 208
1⤵
PID:4676

memory/208-134-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/208-135-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/208-136-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1660-132-0x0000000000010000-0x0000000000028000-memory.dmp

Filesize
96KB

Download
memory/1660-138-0x0000000000010000-0x0000000000028000-memory.dmp

Filesize
96KB

Download