ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1

Analysis

max time kernel
211s
max time network
225s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 07:46

Target

ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe
Size

1.0MB
MD5

bbd2ff1f19d1b7ae88cf0be6350fbe07
SHA1

03b354572268cce8394ceef6287a006426b6419d
SHA256

ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1
SHA512

ebdd2978bad79ae456ff0ca1068db4a40a0adb6fcb2510bfaf22e70199c1dfe653dae56bc21528a09845884d6485ae6a96c3c2ebea6f1c842425b3365599f76e
SSDEEP

12288:RoW5dPenEp953bXeWJOTfo8o+NFJiJRTTw7KuLpJR59i6gANyeVy+dP5:9rPenEp953bQfo8LnAT87D6gyGR

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3536 set thread context of 4464	3536	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4220	3536	WerFault.exe	35

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 4464	3536	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	88
PID 3536 wrote to memory of 4464	3536	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	88
PID 3536 wrote to memory of 4464	3536	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	88
PID 3536 wrote to memory of 4464	3536	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	88
PID 3536 wrote to memory of 4464	3536	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	88
PID 3536 wrote to memory of 4464	3536	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	88
PID 3536 wrote to memory of 4464	3536	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	88
PID 3536 wrote to memory of 4464	3536	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	88
PID 3536 wrote to memory of 4464	3536	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	88
PID 3536 wrote to memory of 4464	3536	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	88

C:\Users\Admin\AppData\Local\Temp\ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe
"C:\Users\Admin\AppData\Local\Temp\ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 72
  2⤵
  - Program crash
  PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3536 -ip 3536
1⤵
PID:4032

memory/4464-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4464-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4464-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4464-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4464-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download