41c46f9e2efd543fcfe113698e6516056df5ead8a245c3c8011a7441d11c2674

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2023, 14:09

Target
file.exe
Size 255KB
Sample230908-rf4vhscd97
SHA256 41c46f9e2efd543fcfe113698e6516056df5ead8a245c3c8011a7441d11c2674
MD5 4036fc0165382dd0fcfa2d39249b715f
SHA1 ecebd8d0eba1e3a8b82743bfa1bf3b50c5ef869b
SHA512 c4793eb2acdc2c2e794397934a890e8d2e1219c253171b52022809f0b3d5eb0c88491fbaef1ba98c6a5e3b4c6d190713586094c642236f24162b038a0a042775
SSDEEP 6144:9S07aTPIBm5KAITPT6DQyAEtD5tRLVwIyDdw:9S07aKEKscWxJxJyDdw
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 324 set thread context of 1280	324	file.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
772	324	WerFault.exe	86

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 324 wrote to memory of 1280	324	file.exe	87
PID 324 wrote to memory of 1280	324	file.exe	87
PID 324 wrote to memory of 1280	324	file.exe	87
PID 324 wrote to memory of 1280	324	file.exe	87
PID 324 wrote to memory of 1280	324	file.exe	87
PID 324 wrote to memory of 1280	324	file.exe	87
PID 324 wrote to memory of 1280	324	file.exe	87
PID 324 wrote to memory of 1280	324	file.exe	87
PID 324 wrote to memory of 1280	324	file.exe	87
PID 324 wrote to memory of 1280	324	file.exe	87

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:324
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 324 -s 236
  2⤵
  - Program crash
  PID:772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 324 -ip 324
1⤵
PID:1124

memory/1280-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1280-1-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1280-2-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1280-3-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1280-4-0x0000000000400000-0x0000000000428000-memory.dmp

Download