831f213d85ff23f8c467a9268b4d34d96c26650c0d1d3c4dd6a2780a0570b18b

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2023, 12:36

Target

831f213d85ff23f8c467a9268b4d34d96c26650c0d1d3c4dd6a2780a0570b18b.exe
Size

329KB
MD5

8b20f4c84414bd31ba694025a810382b
SHA1

5a80c1bc6d42940360b6903296d390e7723a1eb7
SHA256

831f213d85ff23f8c467a9268b4d34d96c26650c0d1d3c4dd6a2780a0570b18b
SHA512

5dd4e8f910e6c98164813106f8a2a687776bcf409141deef55c5eb8ce188acdeebdfcc147f90aa115b49d83c55897e52f5c6274d8c0362d0387ddce9671c4edd
SSDEEP

6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 808 set thread context of 452	808	831f213d85ff23f8c467a9268b4d34d96c26650c0d1d3c4dd6a2780a0570b18b.exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5084	452	WerFault.exe	82

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
452	831f213d85ff23f8c467a9268b4d34d96c26650c0d1d3c4dd6a2780a0570b18b.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 452	808	831f213d85ff23f8c467a9268b4d34d96c26650c0d1d3c4dd6a2780a0570b18b.exe	82
PID 808 wrote to memory of 452	808	831f213d85ff23f8c467a9268b4d34d96c26650c0d1d3c4dd6a2780a0570b18b.exe	82
PID 808 wrote to memory of 452	808	831f213d85ff23f8c467a9268b4d34d96c26650c0d1d3c4dd6a2780a0570b18b.exe	82
PID 808 wrote to memory of 452	808	831f213d85ff23f8c467a9268b4d34d96c26650c0d1d3c4dd6a2780a0570b18b.exe	82
PID 808 wrote to memory of 452	808	831f213d85ff23f8c467a9268b4d34d96c26650c0d1d3c4dd6a2780a0570b18b.exe	82
PID 808 wrote to memory of 452	808	831f213d85ff23f8c467a9268b4d34d96c26650c0d1d3c4dd6a2780a0570b18b.exe	82
PID 808 wrote to memory of 452	808	831f213d85ff23f8c467a9268b4d34d96c26650c0d1d3c4dd6a2780a0570b18b.exe	82
PID 808 wrote to memory of 452	808	831f213d85ff23f8c467a9268b4d34d96c26650c0d1d3c4dd6a2780a0570b18b.exe	82
PID 808 wrote to memory of 452	808	831f213d85ff23f8c467a9268b4d34d96c26650c0d1d3c4dd6a2780a0570b18b.exe	82

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 452 -ip 452
1⤵
PID:3420

memory/452-138-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/808-132-0x0000000000AA0000-0x0000000000AF6000-memory.dmp

Filesize
344KB

Download
memory/808-133-0x0000000008060000-0x0000000008604000-memory.dmp

Filesize
5.6MB

Download
memory/808-134-0x0000000007B50000-0x0000000007BE2000-memory.dmp

Filesize
584KB

Download
memory/808-135-0x0000000007AB0000-0x0000000007B26000-memory.dmp

Filesize
472KB

Download
memory/808-136-0x0000000005710000-0x000000000572E000-memory.dmp

Filesize
120KB

Download