5b0079da607c7c487a0cf9cddc58af881a51a933eb0a13ba1159a5bd38430df6

Analysis

max time kernel
90s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-02-2023 12:14

Target

5b0079da607c7c487a0cf9cddc58af881a51a933eb0a13ba1159a5bd38430df6.exe
Size

329KB
MD5

7e4d394eaf14050211ea99bf1c9341b0
SHA1

b9fbcffb4e0d569f3901160837624a25f4b13110
SHA256

5b0079da607c7c487a0cf9cddc58af881a51a933eb0a13ba1159a5bd38430df6
SHA512

500a7f267b5b39bcf6a95d18e487a28c2d5e2d60390d34ce538dd46a04120c586a4d61b54521e6705c56dca224761bcb2b023b25a6acbeaa803ff46f9c5d2ddc
SSDEEP

6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4288 set thread context of 3780	4288	5b0079da607c7c487a0cf9cddc58af881a51a933eb0a13ba1159a5bd38430df6.exe	76

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3916	3780	WerFault.exe	76

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3780	5b0079da607c7c487a0cf9cddc58af881a51a933eb0a13ba1159a5bd38430df6.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 3780	4288	5b0079da607c7c487a0cf9cddc58af881a51a933eb0a13ba1159a5bd38430df6.exe	76
PID 4288 wrote to memory of 3780	4288	5b0079da607c7c487a0cf9cddc58af881a51a933eb0a13ba1159a5bd38430df6.exe	76
PID 4288 wrote to memory of 3780	4288	5b0079da607c7c487a0cf9cddc58af881a51a933eb0a13ba1159a5bd38430df6.exe	76
PID 4288 wrote to memory of 3780	4288	5b0079da607c7c487a0cf9cddc58af881a51a933eb0a13ba1159a5bd38430df6.exe	76
PID 4288 wrote to memory of 3780	4288	5b0079da607c7c487a0cf9cddc58af881a51a933eb0a13ba1159a5bd38430df6.exe	76
PID 4288 wrote to memory of 3780	4288	5b0079da607c7c487a0cf9cddc58af881a51a933eb0a13ba1159a5bd38430df6.exe	76
PID 4288 wrote to memory of 3780	4288	5b0079da607c7c487a0cf9cddc58af881a51a933eb0a13ba1159a5bd38430df6.exe	76
PID 4288 wrote to memory of 3780	4288	5b0079da607c7c487a0cf9cddc58af881a51a933eb0a13ba1159a5bd38430df6.exe	76
PID 4288 wrote to memory of 3780	4288	5b0079da607c7c487a0cf9cddc58af881a51a933eb0a13ba1159a5bd38430df6.exe	76

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3780 -ip 3780
1⤵
PID:3964

memory/3780-137-0x0000000000000000-mapping.dmp

Download
memory/3780-138-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4288-132-0x0000000000760000-0x00000000007B6000-memory.dmp

Filesize
344KB

Download
memory/4288-133-0x0000000007C00000-0x00000000081A4000-memory.dmp

Filesize
5.6MB

Download
memory/4288-134-0x0000000007730000-0x00000000077C2000-memory.dmp

Filesize
584KB

Download
memory/4288-135-0x00000000079D0000-0x0000000007A46000-memory.dmp

Filesize
472KB

Download
memory/4288-136-0x00000000076F0000-0x000000000770E000-memory.dmp

Filesize
120KB

Download