a0ef1e9a8e603439cec76f919de7d1de23f0377816035682d8b1241c1fc73d71

Analysis

max time kernel
118s
max time network
140s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
11-10-2023 15:45

Target

a0ef1e9a8e603439cec76f919de7d1de23f0377816035682d8b1241c1fc73d71.exe
Size

410KB
MD5

b69436083255c2fb969610fcb25aeda6
SHA1

555835e4f3537228f049acc7d86cc3a5d2c46d2b
SHA256

a0ef1e9a8e603439cec76f919de7d1de23f0377816035682d8b1241c1fc73d71
SHA512

1472e05e403bd4959690426a055255d1f10650e759217d85478ee61fe71fc75d903318581b59731357baf2450644db0454bd2af95cb86d097ffc37b2cc953928
SSDEEP

6144:32ma7I1I+ffSbJ8/rADV6ga9DG4u4AO7brYWPau2dnVVlMo6ZXuPcLvooFskHGcN:3zaX+ffHT9y45fYWP/gMZAcLVGD37w

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2060 set thread context of 712	2060	a0ef1e9a8e603439cec76f919de7d1de23f0377816035682d8b1241c1fc73d71.exe	69

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1184	2060	WerFault.exe	68

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 712	2060	a0ef1e9a8e603439cec76f919de7d1de23f0377816035682d8b1241c1fc73d71.exe	69
PID 2060 wrote to memory of 712	2060	a0ef1e9a8e603439cec76f919de7d1de23f0377816035682d8b1241c1fc73d71.exe	69
PID 2060 wrote to memory of 712	2060	a0ef1e9a8e603439cec76f919de7d1de23f0377816035682d8b1241c1fc73d71.exe	69
PID 2060 wrote to memory of 712	2060	a0ef1e9a8e603439cec76f919de7d1de23f0377816035682d8b1241c1fc73d71.exe	69
PID 2060 wrote to memory of 712	2060	a0ef1e9a8e603439cec76f919de7d1de23f0377816035682d8b1241c1fc73d71.exe	69
PID 2060 wrote to memory of 712	2060	a0ef1e9a8e603439cec76f919de7d1de23f0377816035682d8b1241c1fc73d71.exe	69
PID 2060 wrote to memory of 712	2060	a0ef1e9a8e603439cec76f919de7d1de23f0377816035682d8b1241c1fc73d71.exe	69
PID 2060 wrote to memory of 712	2060	a0ef1e9a8e603439cec76f919de7d1de23f0377816035682d8b1241c1fc73d71.exe	69
PID 2060 wrote to memory of 712	2060	a0ef1e9a8e603439cec76f919de7d1de23f0377816035682d8b1241c1fc73d71.exe	69
PID 2060 wrote to memory of 712	2060	a0ef1e9a8e603439cec76f919de7d1de23f0377816035682d8b1241c1fc73d71.exe	69

C:\Users\Admin\AppData\Local\Temp\a0ef1e9a8e603439cec76f919de7d1de23f0377816035682d8b1241c1fc73d71.exe
"C:\Users\Admin\AppData\Local\Temp\a0ef1e9a8e603439cec76f919de7d1de23f0377816035682d8b1241c1fc73d71.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 232
  2⤵
  - Program crash
  PID:1184

memory/712-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/712-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/712-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/712-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/712-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download