cf8c7c015c876f0a3c82c14c0bab96f81e3b6c19f8ee87efcb744cc5fbf66deb

Analysis

max time kernel
171s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 03:17

Target

cf8c7c015c876f0a3c82c14c0bab96f81e3b6c19f8ee87efcb744cc5fbf66deb.exe
Size

269KB
MD5

ad79e1e4919c87c604244934fabd5559
SHA1

390aee95db736c6400c0640b5b18882160da9c48
SHA256

cf8c7c015c876f0a3c82c14c0bab96f81e3b6c19f8ee87efcb744cc5fbf66deb
SHA512

03bf086f3518be18bb9cfeeaf745db6938fb22ffb1491826573f82788c07eec3ed71927c51b9c20d2f11db7ccf2008200f902a1d0e389876114386129160e02d
SSDEEP

6144:0xotRhtjCI4sHE2MhYS4Qn2r3bHOhc7nRtepgRNWB4dNJOieWu:yotRDOI4sk2MhtGOhfuNWYNJ4l

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 360 set thread context of 1224	360	cf8c7c015c876f0a3c82c14c0bab96f81e3b6c19f8ee87efcb744cc5fbf66deb.exe	81

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4308	1224	WerFault.exe	81

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
360	cf8c7c015c876f0a3c82c14c0bab96f81e3b6c19f8ee87efcb744cc5fbf66deb.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 360 wrote to memory of 1224	360	cf8c7c015c876f0a3c82c14c0bab96f81e3b6c19f8ee87efcb744cc5fbf66deb.exe	81
PID 360 wrote to memory of 1224	360	cf8c7c015c876f0a3c82c14c0bab96f81e3b6c19f8ee87efcb744cc5fbf66deb.exe	81
PID 360 wrote to memory of 1224	360	cf8c7c015c876f0a3c82c14c0bab96f81e3b6c19f8ee87efcb744cc5fbf66deb.exe	81
PID 360 wrote to memory of 1224	360	cf8c7c015c876f0a3c82c14c0bab96f81e3b6c19f8ee87efcb744cc5fbf66deb.exe	81
PID 360 wrote to memory of 1224	360	cf8c7c015c876f0a3c82c14c0bab96f81e3b6c19f8ee87efcb744cc5fbf66deb.exe	81
PID 360 wrote to memory of 1224	360	cf8c7c015c876f0a3c82c14c0bab96f81e3b6c19f8ee87efcb744cc5fbf66deb.exe	81
PID 360 wrote to memory of 1224	360	cf8c7c015c876f0a3c82c14c0bab96f81e3b6c19f8ee87efcb744cc5fbf66deb.exe	81
PID 360 wrote to memory of 1224	360	cf8c7c015c876f0a3c82c14c0bab96f81e3b6c19f8ee87efcb744cc5fbf66deb.exe	81
PID 360 wrote to memory of 1224	360	cf8c7c015c876f0a3c82c14c0bab96f81e3b6c19f8ee87efcb744cc5fbf66deb.exe	81
PID 360 wrote to memory of 1224	360	cf8c7c015c876f0a3c82c14c0bab96f81e3b6c19f8ee87efcb744cc5fbf66deb.exe	81
PID 360 wrote to memory of 1224	360	cf8c7c015c876f0a3c82c14c0bab96f81e3b6c19f8ee87efcb744cc5fbf66deb.exe	81
PID 360 wrote to memory of 1224	360	cf8c7c015c876f0a3c82c14c0bab96f81e3b6c19f8ee87efcb744cc5fbf66deb.exe	81
PID 360 wrote to memory of 1224	360	cf8c7c015c876f0a3c82c14c0bab96f81e3b6c19f8ee87efcb744cc5fbf66deb.exe	81
PID 360 wrote to memory of 1224	360	cf8c7c015c876f0a3c82c14c0bab96f81e3b6c19f8ee87efcb744cc5fbf66deb.exe	81

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1224 -ip 1224
1⤵
PID:208

memory/1224-135-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1224-138-0x0000000000400000-0x0000000000422200-memory.dmp

Filesize
136KB

Download