618d5757cf057b15ac4608340b2c7f641bf56661da501b5084b0fa9212a1dcfd

Analysis

max time kernel
152s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2023, 12:55

Target

47d27bb5f4a208f3081471d00e87d1e4.exe
Size

3.5MB
MD5

47d27bb5f4a208f3081471d00e87d1e4
SHA1

472bb042dc730fddad7d4dd3b48d4369de463845
SHA256

618d5757cf057b15ac4608340b2c7f641bf56661da501b5084b0fa9212a1dcfd
SHA512

fe5acc6c508b77beb34d076b1f58ce17d77101454fdbf6cab573e3cffda683307fdb96979b6d09ad8c4fb09bf89cebb0a2bfabfb0c6f59193a228276be2c5cb5
SSDEEP

24576:wtpH9qTz57hM4/btkcXoTYMl6cexqJJnDIT69NyvONbeKtppAFZg+v:qM57hr7+MxqJJnsT69dbeKtp4

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2812 set thread context of 416	2812	47d27bb5f4a208f3081471d00e87d1e4.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4252	2812	WerFault.exe	83

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 4384	2812	47d27bb5f4a208f3081471d00e87d1e4.exe	84
PID 2812 wrote to memory of 4384	2812	47d27bb5f4a208f3081471d00e87d1e4.exe	84
PID 2812 wrote to memory of 4384	2812	47d27bb5f4a208f3081471d00e87d1e4.exe	84
PID 2812 wrote to memory of 4388	2812	47d27bb5f4a208f3081471d00e87d1e4.exe	85
PID 2812 wrote to memory of 4388	2812	47d27bb5f4a208f3081471d00e87d1e4.exe	85
PID 2812 wrote to memory of 4388	2812	47d27bb5f4a208f3081471d00e87d1e4.exe	85
PID 2812 wrote to memory of 416	2812	47d27bb5f4a208f3081471d00e87d1e4.exe	86
PID 2812 wrote to memory of 416	2812	47d27bb5f4a208f3081471d00e87d1e4.exe	86
PID 2812 wrote to memory of 416	2812	47d27bb5f4a208f3081471d00e87d1e4.exe	86
PID 2812 wrote to memory of 416	2812	47d27bb5f4a208f3081471d00e87d1e4.exe	86
PID 2812 wrote to memory of 416	2812	47d27bb5f4a208f3081471d00e87d1e4.exe	86

C:\Users\Admin\AppData\Local\Temp\47d27bb5f4a208f3081471d00e87d1e4.exe
"C:\Users\Admin\AppData\Local\Temp\47d27bb5f4a208f3081471d00e87d1e4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4384
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4388
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 288
  2⤵
  - Program crash
  PID:4252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2812 -ip 2812
1⤵
PID:3124

memory/416-134-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/416-153-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/416-154-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/416-157-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/416-155-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/2812-133-0x0000000000B00000-0x0000000000EB8000-memory.dmp

Filesize
3.7MB

Download
memory/2812-266-0x0000000000B00000-0x0000000000EB8000-memory.dmp

Filesize
3.7MB

Download