09bca0e017363dbe84d88b9a337532e0b98c8496c563340524d52d214ae33659

Analysis

max time kernel
131s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 04:13

Target

09bca0e017363dbe84d88b9a337532e0b98c8496c563340524d52d214ae33659.exe
Size

1.1MB
MD5

309dff8f880c7d705b0803b6ad9c12fb
SHA1

083e8d5810cc89065d77509ffadce4db2469c669
SHA256

09bca0e017363dbe84d88b9a337532e0b98c8496c563340524d52d214ae33659
SHA512

789f4e05af3e09a5db8b805bd1e2680f52434de64c486e176dd368a9ac7dcd9c025fd2eb59b726bac657fb6fb801acfff3a20e35ad14ff64f4cc44a55a269e4a
SSDEEP

24576:IPp4xRE+4WPBfvgyC8+6/K32r8QZiKBU+nk:IEE+4WPBX+WK37Qrnk

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2548 set thread context of 4352	2548	09bca0e017363dbe84d88b9a337532e0b98c8496c563340524d52d214ae33659.exe	89

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3876	2548	WerFault.exe	81

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 4352	2548	09bca0e017363dbe84d88b9a337532e0b98c8496c563340524d52d214ae33659.exe	89
PID 2548 wrote to memory of 4352	2548	09bca0e017363dbe84d88b9a337532e0b98c8496c563340524d52d214ae33659.exe	89
PID 2548 wrote to memory of 4352	2548	09bca0e017363dbe84d88b9a337532e0b98c8496c563340524d52d214ae33659.exe	89
PID 2548 wrote to memory of 4352	2548	09bca0e017363dbe84d88b9a337532e0b98c8496c563340524d52d214ae33659.exe	89
PID 2548 wrote to memory of 4352	2548	09bca0e017363dbe84d88b9a337532e0b98c8496c563340524d52d214ae33659.exe	89
PID 2548 wrote to memory of 4352	2548	09bca0e017363dbe84d88b9a337532e0b98c8496c563340524d52d214ae33659.exe	89
PID 2548 wrote to memory of 4352	2548	09bca0e017363dbe84d88b9a337532e0b98c8496c563340524d52d214ae33659.exe	89
PID 2548 wrote to memory of 4352	2548	09bca0e017363dbe84d88b9a337532e0b98c8496c563340524d52d214ae33659.exe	89
PID 2548 wrote to memory of 4352	2548	09bca0e017363dbe84d88b9a337532e0b98c8496c563340524d52d214ae33659.exe	89
PID 2548 wrote to memory of 4352	2548	09bca0e017363dbe84d88b9a337532e0b98c8496c563340524d52d214ae33659.exe	89

C:\Users\Admin\AppData\Local\Temp\09bca0e017363dbe84d88b9a337532e0b98c8496c563340524d52d214ae33659.exe
"C:\Users\Admin\AppData\Local\Temp\09bca0e017363dbe84d88b9a337532e0b98c8496c563340524d52d214ae33659.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 240
  2⤵
  - Program crash
  PID:3876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2548 -ip 2548
1⤵
PID:1064

memory/4352-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4352-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4352-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4352-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4352-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download