3c17e31ed7c3dfa69dcf960a5521260ddcfe6e86552d8d7f1a061daf05328a90

Analysis

max time kernel
133s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 11:26

Target

file.exe
Size

1.1MB
MD5

fcc0c9eb453fb43290bc0be34c2c2d25
SHA1

5fbbcd39d719525b7ab235ba36a3191b10652408
SHA256

3c17e31ed7c3dfa69dcf960a5521260ddcfe6e86552d8d7f1a061daf05328a90
SHA512

c56f79d05f14fcefcad4ee1339bff90fdb938730ca56072c53e5db8c1de188858fafd2bb270db0c39c796472853f256012c92ddd7f7c823c1ff9cffe9e207398
SSDEEP

12288:9NswnN2dA1IY9i4ytPDxZZZVf95Tjz8L2aB4vIubLk48Fyf4ruqMfL8lhrG82fHY:bswN2dA1h9i4ytXVX3dAfMQlNG82fcAW

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4836 set thread context of 2068	4836	file.exe	85

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1536	4836	WerFault.exe	81

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 2068	4836	file.exe	85
PID 4836 wrote to memory of 2068	4836	file.exe	85
PID 4836 wrote to memory of 2068	4836	file.exe	85
PID 4836 wrote to memory of 2068	4836	file.exe	85
PID 4836 wrote to memory of 2068	4836	file.exe	85
PID 4836 wrote to memory of 2068	4836	file.exe	85
PID 4836 wrote to memory of 2068	4836	file.exe	85
PID 4836 wrote to memory of 2068	4836	file.exe	85
PID 4836 wrote to memory of 2068	4836	file.exe	85
PID 4836 wrote to memory of 2068	4836	file.exe	85

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 160
  2⤵
  - Program crash
  PID:1536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4836 -ip 4836
1⤵
PID:3972

memory/2068-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2068-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2068-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2068-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2068-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download