0e499af5693e743c4451de607e65d9c3281caf1f2de6b657bb951408a625ec49

Analysis

max time kernel
135s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2023, 07:23

Target

0e499af5693e743c4451de607e65d9c3281caf1f2de6b657bb951408a625ec49.exe
Size

1.1MB
MD5

28b764fdee44dc56a1c659a673258b19
SHA1

0ffc559bdc885287c51a76eac0005ca3cc89b036
SHA256

0e499af5693e743c4451de607e65d9c3281caf1f2de6b657bb951408a625ec49
SHA512

a0f0b23c176ca31aafdc2f0eca17f9798de124ec373e0419bbc4da454db4f37c11012eef4cc926f3343567b956a80cc1cf4c3fe6ffe7d5509f03c7588044434c
SSDEEP

24576:MH62dASetf+BVzsGIoRj3cBWNk8Psp3F:Cetf+BVzIwm+E

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4188 set thread context of 1792	4188	0e499af5693e743c4451de607e65d9c3281caf1f2de6b657bb951408a625ec49.exe	91

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2492	4188	WerFault.exe	86

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 1792	4188	0e499af5693e743c4451de607e65d9c3281caf1f2de6b657bb951408a625ec49.exe	91
PID 4188 wrote to memory of 1792	4188	0e499af5693e743c4451de607e65d9c3281caf1f2de6b657bb951408a625ec49.exe	91
PID 4188 wrote to memory of 1792	4188	0e499af5693e743c4451de607e65d9c3281caf1f2de6b657bb951408a625ec49.exe	91
PID 4188 wrote to memory of 1792	4188	0e499af5693e743c4451de607e65d9c3281caf1f2de6b657bb951408a625ec49.exe	91
PID 4188 wrote to memory of 1792	4188	0e499af5693e743c4451de607e65d9c3281caf1f2de6b657bb951408a625ec49.exe	91
PID 4188 wrote to memory of 1792	4188	0e499af5693e743c4451de607e65d9c3281caf1f2de6b657bb951408a625ec49.exe	91
PID 4188 wrote to memory of 1792	4188	0e499af5693e743c4451de607e65d9c3281caf1f2de6b657bb951408a625ec49.exe	91
PID 4188 wrote to memory of 1792	4188	0e499af5693e743c4451de607e65d9c3281caf1f2de6b657bb951408a625ec49.exe	91
PID 4188 wrote to memory of 1792	4188	0e499af5693e743c4451de607e65d9c3281caf1f2de6b657bb951408a625ec49.exe	91
PID 4188 wrote to memory of 1792	4188	0e499af5693e743c4451de607e65d9c3281caf1f2de6b657bb951408a625ec49.exe	91

C:\Users\Admin\AppData\Local\Temp\0e499af5693e743c4451de607e65d9c3281caf1f2de6b657bb951408a625ec49.exe
"C:\Users\Admin\AppData\Local\Temp\0e499af5693e743c4451de607e65d9c3281caf1f2de6b657bb951408a625ec49.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 320
  2⤵
  - Program crash
  PID:2492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4188 -ip 4188
1⤵
PID:4176

memory/1792-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1792-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1792-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1792-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1792-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download