8ffc4adaf0a358210e159d081e3e41f7092693e054eaeb7ab01458153a3be02e

Analysis

max time kernel
162s
max time network
180s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
12-10-2023 03:16

Target

8ffc4adaf0a358210e159d081e3e41f7092693e054eaeb7ab01458153a3be02e.exe
Size

1.1MB
MD5

3c925431692c70799fb97a182bcc53b7
SHA1

be118e2fc848638b29dbcc821bbc8cf889a9948a
SHA256

8ffc4adaf0a358210e159d081e3e41f7092693e054eaeb7ab01458153a3be02e
SHA512

b2f50e12fea4e9347802aabb7f1a39b49dfbae266d50836a8f7e703f5dcb9d5944fda5a6b737d302559c6cd059e7c6128267da2dc3861845f95f1146b690ad54
SSDEEP

12288:kqtHzPp4xPpE+4WPoxOMe6H4OtyCmBThQ6/HNmua9kX0eVr5+Rnk:nPp4xRE+4WPBfvgyC8+6/t0eF56nk

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3148 set thread context of 1124	3148	8ffc4adaf0a358210e159d081e3e41f7092693e054eaeb7ab01458153a3be02e.exe	71

Program crash 1 IoCs

pid	pid_target	Process	procid_target
396	3148	WerFault.exe	69

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 1124	3148	8ffc4adaf0a358210e159d081e3e41f7092693e054eaeb7ab01458153a3be02e.exe	71
PID 3148 wrote to memory of 1124	3148	8ffc4adaf0a358210e159d081e3e41f7092693e054eaeb7ab01458153a3be02e.exe	71
PID 3148 wrote to memory of 1124	3148	8ffc4adaf0a358210e159d081e3e41f7092693e054eaeb7ab01458153a3be02e.exe	71
PID 3148 wrote to memory of 1124	3148	8ffc4adaf0a358210e159d081e3e41f7092693e054eaeb7ab01458153a3be02e.exe	71
PID 3148 wrote to memory of 1124	3148	8ffc4adaf0a358210e159d081e3e41f7092693e054eaeb7ab01458153a3be02e.exe	71
PID 3148 wrote to memory of 1124	3148	8ffc4adaf0a358210e159d081e3e41f7092693e054eaeb7ab01458153a3be02e.exe	71
PID 3148 wrote to memory of 1124	3148	8ffc4adaf0a358210e159d081e3e41f7092693e054eaeb7ab01458153a3be02e.exe	71
PID 3148 wrote to memory of 1124	3148	8ffc4adaf0a358210e159d081e3e41f7092693e054eaeb7ab01458153a3be02e.exe	71
PID 3148 wrote to memory of 1124	3148	8ffc4adaf0a358210e159d081e3e41f7092693e054eaeb7ab01458153a3be02e.exe	71
PID 3148 wrote to memory of 1124	3148	8ffc4adaf0a358210e159d081e3e41f7092693e054eaeb7ab01458153a3be02e.exe	71

C:\Users\Admin\AppData\Local\Temp\8ffc4adaf0a358210e159d081e3e41f7092693e054eaeb7ab01458153a3be02e.exe
"C:\Users\Admin\AppData\Local\Temp\8ffc4adaf0a358210e159d081e3e41f7092693e054eaeb7ab01458153a3be02e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 192
  2⤵
  - Program crash
  PID:396

memory/1124-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1124-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1124-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1124-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1124-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1124-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download