dc608d826299cfee0866c40e64c996ac544c96b064c2e359c82429bdf3ff7309

Analysis

max time kernel
258s
max time network
288s
platform
windows10-1703_x64
resource
win10-20230831-en
resource tags

arch:x64arch:x86image:win10-20230831-enlocale:en-usos:windows10-1703-x64system
submitted
10/10/2023, 01:03

Target

1YZ83RQ4.exe
Size

423KB
MD5

41eda244db595adbe8ce28edee87429e
SHA1

c45a1515333cf5f5219ff94bc342cec64c8682ac
SHA256

dc608d826299cfee0866c40e64c996ac544c96b064c2e359c82429bdf3ff7309
SHA512

fc9cd50ef43946944c4867dd6b8d9a7f210a17b7a30c7c5083fb74968099327145aa143007f761169eae388c19f2116e6bda0495f10656549a84c5d1667e4633
SSDEEP

6144:oDofpu01XFBvaKAwQtdsJlfpoCJAO081Wziu4aLpxYecqS3ZjajqQrlS:oDoxf1XFBC2JQCJP3u7p6v3ZuJrlS

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3104 set thread context of 672	3104	1YZ83RQ4.exe	70

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4916	3104	WerFault.exe	69

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 672	3104	1YZ83RQ4.exe	70
PID 3104 wrote to memory of 672	3104	1YZ83RQ4.exe	70
PID 3104 wrote to memory of 672	3104	1YZ83RQ4.exe	70
PID 3104 wrote to memory of 672	3104	1YZ83RQ4.exe	70
PID 3104 wrote to memory of 672	3104	1YZ83RQ4.exe	70
PID 3104 wrote to memory of 672	3104	1YZ83RQ4.exe	70
PID 3104 wrote to memory of 672	3104	1YZ83RQ4.exe	70
PID 3104 wrote to memory of 672	3104	1YZ83RQ4.exe	70
PID 3104 wrote to memory of 672	3104	1YZ83RQ4.exe	70
PID 3104 wrote to memory of 672	3104	1YZ83RQ4.exe	70

C:\Users\Admin\AppData\Local\Temp\1YZ83RQ4.exe
"C:\Users\Admin\AppData\Local\Temp\1YZ83RQ4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 336
  2⤵
  - Program crash
  PID:4916

memory/672-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/672-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/672-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/672-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/672-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download