d0873782fa5d4851ddd95e98767467d177e1b42a684b202cd681968ea2ece832

Analysis

max time kernel
151s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2023, 11:48

Target
6f5d1121329d0d0a7ce4f859a45ea19e.exe
Size 2.9MB
Sample230619-nyfc4aef9t
SHA256 d0873782fa5d4851ddd95e98767467d177e1b42a684b202cd681968ea2ece832
MD5 6f5d1121329d0d0a7ce4f859a45ea19e
SHA1 6c9e310bd320e0b79b800c453face75a04c1eab2
SHA512 40efa8dda4ac12858b52bacefbcab681940706b8609ce796243a04e0b03d0bef74217a8af9c18c07e779322366d6b1baee8a56bde799b8cfb9f7edbb8f1ef6db
SSDEEP 49152:MBX90Qt0bROaKW/4aboqlSEo970lLVgJEdXx8F5L5ka5LhUlIBZdPjHpBM0yyUsu:CsR5KVjqlSEo9709SJwXx8H5ka5LhUl5
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1648 set thread context of 2300	1648	6f5d1121329d0d0a7ce4f859a45ea19e.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3152	1648	WerFault.exe	83

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1112	1648	6f5d1121329d0d0a7ce4f859a45ea19e.exe	85
PID 1648 wrote to memory of 1112	1648	6f5d1121329d0d0a7ce4f859a45ea19e.exe	85
PID 1648 wrote to memory of 1112	1648	6f5d1121329d0d0a7ce4f859a45ea19e.exe	85
PID 1648 wrote to memory of 4464	1648	6f5d1121329d0d0a7ce4f859a45ea19e.exe	86
PID 1648 wrote to memory of 4464	1648	6f5d1121329d0d0a7ce4f859a45ea19e.exe	86
PID 1648 wrote to memory of 4464	1648	6f5d1121329d0d0a7ce4f859a45ea19e.exe	86
PID 1648 wrote to memory of 2300	1648	6f5d1121329d0d0a7ce4f859a45ea19e.exe	87
PID 1648 wrote to memory of 2300	1648	6f5d1121329d0d0a7ce4f859a45ea19e.exe	87
PID 1648 wrote to memory of 2300	1648	6f5d1121329d0d0a7ce4f859a45ea19e.exe	87
PID 1648 wrote to memory of 2300	1648	6f5d1121329d0d0a7ce4f859a45ea19e.exe	87
PID 1648 wrote to memory of 2300	1648	6f5d1121329d0d0a7ce4f859a45ea19e.exe	87

C:\Users\Admin\AppData\Local\Temp\6f5d1121329d0d0a7ce4f859a45ea19e.exe
"C:\Users\Admin\AppData\Local\Temp\6f5d1121329d0d0a7ce4f859a45ea19e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:1112
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:4464
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:2300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 392
  2⤵
  - Program crash
  PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1648 -ip 1648
1⤵
PID:1400

memory/2300-133-0x0000000000400000-0x000000000056C000-memory.dmp

Download

memory/2300-152-0x0000000000400000-0x000000000056C000-memory.dmp

Download

memory/2300-153-0x0000000000400000-0x000000000056C000-memory.dmp

Download

memory/2300-154-0x0000000000400000-0x000000000056C000-memory.dmp

Download

memory/2300-156-0x0000000000400000-0x000000000056C000-memory.dmp

Download