381916d6fb7edc9c8173fe16c87eed4c133c5ee9eaaa721f3d69eb3db044c06f

Analysis

max time kernel
140s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2023, 20:29

Target

file.exe
Size

1.1MB
MD5

20b96c0bbcd693d63c7ed10fb41de166
SHA1

af1481a6f6328879f64208090fa42f165bc58136
SHA256

381916d6fb7edc9c8173fe16c87eed4c133c5ee9eaaa721f3d69eb3db044c06f
SHA512

2b45b889b784313a110832eef1315d38a14a8822b5f8192607fc247582ae158ebc4ad1c29a7193f78400aba7b9aa057ab3273b9e9a22ffcfe766080f41d4948b
SSDEEP

12288:vls86N2dA1IY9i4ytPrJx5ZVfV5TjzBTVyh43IubL5SnhwoUOfKUJACpA08crPoJ:Ns8Y2dA1h9i4ytvV/3d+6xDCT9rjA/

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3860 set thread context of 4056	3860	file.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2000	3860	WerFault.exe	80

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3860 wrote to memory of 4056	3860	file.exe	83
PID 3860 wrote to memory of 4056	3860	file.exe	83
PID 3860 wrote to memory of 4056	3860	file.exe	83
PID 3860 wrote to memory of 4056	3860	file.exe	83
PID 3860 wrote to memory of 4056	3860	file.exe	83
PID 3860 wrote to memory of 4056	3860	file.exe	83
PID 3860 wrote to memory of 4056	3860	file.exe	83
PID 3860 wrote to memory of 4056	3860	file.exe	83
PID 3860 wrote to memory of 4056	3860	file.exe	83
PID 3860 wrote to memory of 4056	3860	file.exe	83

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 296
  2⤵
  - Program crash
  PID:2000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3860 -ip 3860
1⤵
PID:2568

memory/4056-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4056-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4056-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4056-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4056-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download