ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0deb

Analysis

max time kernel
139s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2023, 19:10

Target

ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe
Size

671KB
MD5

221bb71916e1e9d532ae7022869d55ae
SHA1

241dc48d97b2f7527c21f3bb78ab1646de099b18
SHA256

ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0deb
SHA512

14af6d828ccd7712b2ceb4ee8a2129ee4ae11a492034ec0f904edf4e4585ccb3e7f98fc54641d7443998c621ad49edba8654fc811351f7968f60b8d39500718b
SSDEEP

12288:jgN4/W78H0gxU2QYLMoXbCrcp2YhRLvLY9YhT6oc8kJrhr4QD2s0BC+:OUW7u0T2TL/XmqhhY9YV6oc8k7r4q0l

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 792 set thread context of 3016	792	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
556	792	WerFault.exe	32

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 4564	792	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	87
PID 792 wrote to memory of 4564	792	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	87
PID 792 wrote to memory of 4564	792	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	87
PID 792 wrote to memory of 3016	792	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	88
PID 792 wrote to memory of 3016	792	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	88
PID 792 wrote to memory of 3016	792	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	88
PID 792 wrote to memory of 3016	792	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	88
PID 792 wrote to memory of 3016	792	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	88
PID 792 wrote to memory of 3016	792	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	88
PID 792 wrote to memory of 3016	792	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	88
PID 792 wrote to memory of 3016	792	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	88
PID 792 wrote to memory of 3016	792	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	88

C:\Users\Admin\AppData\Local\Temp\ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:792
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4564
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 268
  2⤵
  - Program crash
  PID:556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 792 -ip 792
1⤵
PID:4484

memory/3016-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3016-1-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3016-2-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3016-3-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3016-4-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download