970ee75d9e73756e91ca0315e6c5fd43d289853dc2a53af85b0a7be664d4b259

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2023, 05:42

Target
file.exe
Size 264KB
Sample230908-gd1d7sha41
SHA256 970ee75d9e73756e91ca0315e6c5fd43d289853dc2a53af85b0a7be664d4b259
MD5 94471609dd70a73495cd6be83131cd5b
SHA1 dd002223a8bc9ce626ebf6e977a092c8d7bbb466
SHA512 45161571458d293152e493104a435bdb369eb63db36b462b15984af2b300cdd4a87fcc39066303fc28587016e6e2c31a8130b2094fe26d244429a8a163dffbbd
SSDEEP 6144:fh6PWu9nd1kCh2EonmwXS0FfrsnqkPx2RIJaOIFrAannnYuV/0ghgZ:fgdHkCgXS0xrsnqkPgyJBIFrAtuV/0gG
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2628 set thread context of 452	2628	file.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2020	2628	WerFault.exe	86

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 452	2628	file.exe	88
PID 2628 wrote to memory of 452	2628	file.exe	88
PID 2628 wrote to memory of 452	2628	file.exe	88
PID 2628 wrote to memory of 452	2628	file.exe	88
PID 2628 wrote to memory of 452	2628	file.exe	88
PID 2628 wrote to memory of 452	2628	file.exe	88
PID 2628 wrote to memory of 452	2628	file.exe	88
PID 2628 wrote to memory of 452	2628	file.exe	88
PID 2628 wrote to memory of 452	2628	file.exe	88
PID 2628 wrote to memory of 452	2628	file.exe	88

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 236
  2⤵
  - Program crash
  PID:2020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2628 -ip 2628
1⤵
PID:4060

memory/452-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/452-1-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/452-2-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/452-3-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/452-4-0x0000000000400000-0x0000000000428000-memory.dmp

Download