116ef31a0e84bdd4cfab421559d9b05f210113d7b1c3c59caca507de6c201116

Analysis

max time kernel
124s
max time network
130s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
14/10/2023, 14:58

Target

116ef31a0e84bdd4cfab421559d9b05f210113d7b1c3c59caca507de6c201116.exe
Size

298KB
MD5

4b41a648be353590109c65f6eac769f5
SHA1

b29dbac9d2ef8b8ea838859c0982d1e3ec8b98af
SHA256

116ef31a0e84bdd4cfab421559d9b05f210113d7b1c3c59caca507de6c201116
SHA512

e8e917facaec1f0041bd0e77c9461068368cb5e1d29d2e72a459176fac20a11597350b1fcb60b6e38e96b21a32998916fecf39cbaa297943718ac45a7d5f73fa
SSDEEP

6144:aNJsICnU9Q8sr7G6bvWVyVfTM17HfBPDrG6HFaF33b4XY77EpfIEdzkPoJ:aHsICnJPbvWk7Ml/Jqq04I3ELzkPoJ

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4840 set thread context of 3232	4840	116ef31a0e84bdd4cfab421559d9b05f210113d7b1c3c59caca507de6c201116.exe	72

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3940	4840	WerFault.exe	69

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 4552	4840	116ef31a0e84bdd4cfab421559d9b05f210113d7b1c3c59caca507de6c201116.exe	71
PID 4840 wrote to memory of 4552	4840	116ef31a0e84bdd4cfab421559d9b05f210113d7b1c3c59caca507de6c201116.exe	71
PID 4840 wrote to memory of 4552	4840	116ef31a0e84bdd4cfab421559d9b05f210113d7b1c3c59caca507de6c201116.exe	71
PID 4840 wrote to memory of 3232	4840	116ef31a0e84bdd4cfab421559d9b05f210113d7b1c3c59caca507de6c201116.exe	72
PID 4840 wrote to memory of 3232	4840	116ef31a0e84bdd4cfab421559d9b05f210113d7b1c3c59caca507de6c201116.exe	72
PID 4840 wrote to memory of 3232	4840	116ef31a0e84bdd4cfab421559d9b05f210113d7b1c3c59caca507de6c201116.exe	72
PID 4840 wrote to memory of 3232	4840	116ef31a0e84bdd4cfab421559d9b05f210113d7b1c3c59caca507de6c201116.exe	72
PID 4840 wrote to memory of 3232	4840	116ef31a0e84bdd4cfab421559d9b05f210113d7b1c3c59caca507de6c201116.exe	72
PID 4840 wrote to memory of 3232	4840	116ef31a0e84bdd4cfab421559d9b05f210113d7b1c3c59caca507de6c201116.exe	72
PID 4840 wrote to memory of 3232	4840	116ef31a0e84bdd4cfab421559d9b05f210113d7b1c3c59caca507de6c201116.exe	72
PID 4840 wrote to memory of 3232	4840	116ef31a0e84bdd4cfab421559d9b05f210113d7b1c3c59caca507de6c201116.exe	72
PID 4840 wrote to memory of 3232	4840	116ef31a0e84bdd4cfab421559d9b05f210113d7b1c3c59caca507de6c201116.exe	72
PID 4840 wrote to memory of 3232	4840	116ef31a0e84bdd4cfab421559d9b05f210113d7b1c3c59caca507de6c201116.exe	72

C:\Users\Admin\AppData\Local\Temp\116ef31a0e84bdd4cfab421559d9b05f210113d7b1c3c59caca507de6c201116.exe
"C:\Users\Admin\AppData\Local\Temp\116ef31a0e84bdd4cfab421559d9b05f210113d7b1c3c59caca507de6c201116.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4552
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 260
  2⤵
  - Program crash
  PID:3940

memory/3232-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3232-3-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3232-4-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3232-5-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3232-6-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download