1e34f41da8e5da71bc996a17acb2bbfa98fdd3bfe0394098382304a266d350f7

Analysis

max time kernel
98s
max time network
123s
platform
windows10-1703_x64
resource
win10-20230831-en
resource tags

arch:x64arch:x86image:win10-20230831-enlocale:en-usos:windows10-1703-x64system
submitted
13/10/2023, 00:34

Target

1e34f41da8e5da71bc996a17acb2bbfa98fdd3bfe0394098382304a266d350f7.exe
Size

1.1MB
MD5

99d42d62503878618af104d001bf5471
SHA1

ba353bda696d148bc713b2fa16aaef3dc479c7d1
SHA256

1e34f41da8e5da71bc996a17acb2bbfa98fdd3bfe0394098382304a266d350f7
SHA512

877633e6de63e3bbca80cb0ddc517bbc777639a5ceb91b85c583418a7886a83fcd3a8e08acbafa339c9088c300edaf8740537b5216ef48dea5044b3fa0a34d03
SSDEEP

24576:/SLyjCokJEojUZ/45iSadj60/TDq7DyQ:/4okJEojk/13dj1Cv7

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4480 set thread context of 4144	4480	1e34f41da8e5da71bc996a17acb2bbfa98fdd3bfe0394098382304a266d350f7.exe	70

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4364	4480	WerFault.exe	68

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 4144	4480	1e34f41da8e5da71bc996a17acb2bbfa98fdd3bfe0394098382304a266d350f7.exe	70
PID 4480 wrote to memory of 4144	4480	1e34f41da8e5da71bc996a17acb2bbfa98fdd3bfe0394098382304a266d350f7.exe	70
PID 4480 wrote to memory of 4144	4480	1e34f41da8e5da71bc996a17acb2bbfa98fdd3bfe0394098382304a266d350f7.exe	70
PID 4480 wrote to memory of 4144	4480	1e34f41da8e5da71bc996a17acb2bbfa98fdd3bfe0394098382304a266d350f7.exe	70
PID 4480 wrote to memory of 4144	4480	1e34f41da8e5da71bc996a17acb2bbfa98fdd3bfe0394098382304a266d350f7.exe	70
PID 4480 wrote to memory of 4144	4480	1e34f41da8e5da71bc996a17acb2bbfa98fdd3bfe0394098382304a266d350f7.exe	70
PID 4480 wrote to memory of 4144	4480	1e34f41da8e5da71bc996a17acb2bbfa98fdd3bfe0394098382304a266d350f7.exe	70
PID 4480 wrote to memory of 4144	4480	1e34f41da8e5da71bc996a17acb2bbfa98fdd3bfe0394098382304a266d350f7.exe	70
PID 4480 wrote to memory of 4144	4480	1e34f41da8e5da71bc996a17acb2bbfa98fdd3bfe0394098382304a266d350f7.exe	70
PID 4480 wrote to memory of 4144	4480	1e34f41da8e5da71bc996a17acb2bbfa98fdd3bfe0394098382304a266d350f7.exe	70

C:\Users\Admin\AppData\Local\Temp\1e34f41da8e5da71bc996a17acb2bbfa98fdd3bfe0394098382304a266d350f7.exe
"C:\Users\Admin\AppData\Local\Temp\1e34f41da8e5da71bc996a17acb2bbfa98fdd3bfe0394098382304a266d350f7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 232
  2⤵
  - Program crash
  PID:4364

memory/4144-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4144-3-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4144-4-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4144-5-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4144-6-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download