d21782411c5b2bb91b735a1935ceb15be348b0086909cdd6b81f0d0d1c750f98

Analysis

max time kernel
124s
max time network
133s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
11-10-2023 22:01

Target

d21782411c5b2bb91b735a1935ceb15be348b0086909cdd6b81f0d0d1c750f98.exe
Size

1.1MB
MD5

f4484f431fbf54d3f1bb3104284f91f5
SHA1

e134e00ddd10e7989603682c41132db82e73a30c
SHA256

d21782411c5b2bb91b735a1935ceb15be348b0086909cdd6b81f0d0d1c750f98
SHA512

31d86506c728885353e269c5802242b2aa7293b41c45a5a9bb5cf55428158565633cecca0083dab6454175df023e25e24b5af39e48c1c5c0c04f1e0ae0a33d39
SSDEEP

12288:mK4PzPp4xPpE+4WPoxOMOSv4G9yCfROYQ6Hn1/ua9BlGV8ItJLzoMDQP/WnRnq:APp4xRE+4WPBfP4yCJk6HItloMu/WRnq

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4352 set thread context of 4120	4352	d21782411c5b2bb91b735a1935ceb15be348b0086909cdd6b81f0d0d1c750f98.exe	71

Program crash 1 IoCs

pid	pid_target	Process	procid_target
772	4352	WerFault.exe	68

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 920	4352	d21782411c5b2bb91b735a1935ceb15be348b0086909cdd6b81f0d0d1c750f98.exe	70
PID 4352 wrote to memory of 920	4352	d21782411c5b2bb91b735a1935ceb15be348b0086909cdd6b81f0d0d1c750f98.exe	70
PID 4352 wrote to memory of 920	4352	d21782411c5b2bb91b735a1935ceb15be348b0086909cdd6b81f0d0d1c750f98.exe	70
PID 4352 wrote to memory of 4120	4352	d21782411c5b2bb91b735a1935ceb15be348b0086909cdd6b81f0d0d1c750f98.exe	71
PID 4352 wrote to memory of 4120	4352	d21782411c5b2bb91b735a1935ceb15be348b0086909cdd6b81f0d0d1c750f98.exe	71
PID 4352 wrote to memory of 4120	4352	d21782411c5b2bb91b735a1935ceb15be348b0086909cdd6b81f0d0d1c750f98.exe	71
PID 4352 wrote to memory of 4120	4352	d21782411c5b2bb91b735a1935ceb15be348b0086909cdd6b81f0d0d1c750f98.exe	71
PID 4352 wrote to memory of 4120	4352	d21782411c5b2bb91b735a1935ceb15be348b0086909cdd6b81f0d0d1c750f98.exe	71
PID 4352 wrote to memory of 4120	4352	d21782411c5b2bb91b735a1935ceb15be348b0086909cdd6b81f0d0d1c750f98.exe	71
PID 4352 wrote to memory of 4120	4352	d21782411c5b2bb91b735a1935ceb15be348b0086909cdd6b81f0d0d1c750f98.exe	71
PID 4352 wrote to memory of 4120	4352	d21782411c5b2bb91b735a1935ceb15be348b0086909cdd6b81f0d0d1c750f98.exe	71
PID 4352 wrote to memory of 4120	4352	d21782411c5b2bb91b735a1935ceb15be348b0086909cdd6b81f0d0d1c750f98.exe	71
PID 4352 wrote to memory of 4120	4352	d21782411c5b2bb91b735a1935ceb15be348b0086909cdd6b81f0d0d1c750f98.exe	71

C:\Users\Admin\AppData\Local\Temp\d21782411c5b2bb91b735a1935ceb15be348b0086909cdd6b81f0d0d1c750f98.exe
"C:\Users\Admin\AppData\Local\Temp\d21782411c5b2bb91b735a1935ceb15be348b0086909cdd6b81f0d0d1c750f98.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 136
  2⤵
  - Program crash
  PID:772

memory/4120-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4120-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4120-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4120-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4120-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download