ffdbe77f05c3e8a92a71ce8fb340778cca5f7d1a4611a18fb53f1dff884db029

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2023, 01:57

Target

ebaa05165e9a04e110a016a74016effe016f9e19c83fc73f25ed6b3c49db40d8.exe
Size

607KB
MD5

6ce870a87a39787ab4fa77da3fec640f
SHA1

56884811262008dd1d364d2b9cde2383ae9946b9
SHA256

ebaa05165e9a04e110a016a74016effe016f9e19c83fc73f25ed6b3c49db40d8
SHA512

42fab0285165752caf2be3c82b49aedea8876ccf089d225ab8811d52e3931f3d8cf8ba42ae4b616b2780a0975aa92b05439b34236520c7fb7eee8e4d49445217
SSDEEP

12288:h8oU24xPyMrknWwli74hhYglFSXQDZ3B5tQrS5ninWzIGWJ:afxnkWw41gHSXMZntQrKedG

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4668 set thread context of 1540	4668	ebaa05165e9a04e110a016a74016effe016f9e19c83fc73f25ed6b3c49db40d8.exe	93

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4836	1540	WerFault.exe	93

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1540	ebaa05165e9a04e110a016a74016effe016f9e19c83fc73f25ed6b3c49db40d8.exe
1540	ebaa05165e9a04e110a016a74016effe016f9e19c83fc73f25ed6b3c49db40d8.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 1540	4668	ebaa05165e9a04e110a016a74016effe016f9e19c83fc73f25ed6b3c49db40d8.exe	93
PID 4668 wrote to memory of 1540	4668	ebaa05165e9a04e110a016a74016effe016f9e19c83fc73f25ed6b3c49db40d8.exe	93
PID 4668 wrote to memory of 1540	4668	ebaa05165e9a04e110a016a74016effe016f9e19c83fc73f25ed6b3c49db40d8.exe	93
PID 4668 wrote to memory of 1540	4668	ebaa05165e9a04e110a016a74016effe016f9e19c83fc73f25ed6b3c49db40d8.exe	93
PID 4668 wrote to memory of 1540	4668	ebaa05165e9a04e110a016a74016effe016f9e19c83fc73f25ed6b3c49db40d8.exe	93
PID 4668 wrote to memory of 1540	4668	ebaa05165e9a04e110a016a74016effe016f9e19c83fc73f25ed6b3c49db40d8.exe	93

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1540 -ip 1540
1⤵
PID:4376

memory/1540-11-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1540-15-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1540-14-0x0000000001310000-0x000000000165A000-memory.dmp

Filesize
3.3MB

Download
memory/4668-6-0x0000000005B10000-0x0000000005BAC000-memory.dmp

Filesize
624KB

Download
memory/4668-4-0x0000000005870000-0x0000000005880000-memory.dmp

Filesize
64KB

Download
memory/4668-5-0x0000000005960000-0x000000000596A000-memory.dmp

Filesize
40KB

Download
memory/4668-0-0x0000000074F20000-0x00000000756D0000-memory.dmp

Filesize
7.7MB

Download
memory/4668-7-0x0000000005D20000-0x0000000005D32000-memory.dmp

Filesize
72KB

Download
memory/4668-8-0x0000000006470000-0x0000000006478000-memory.dmp

Filesize
32KB

Download
memory/4668-9-0x0000000006490000-0x000000000649A000-memory.dmp

Filesize
40KB

Download
memory/4668-10-0x0000000006C00000-0x0000000006C7E000-memory.dmp

Filesize
504KB

Download
memory/4668-3-0x0000000005890000-0x0000000005922000-memory.dmp

Filesize
584KB

Download
memory/4668-13-0x0000000074F20000-0x00000000756D0000-memory.dmp

Filesize
7.7MB

Download
memory/4668-2-0x0000000005D50000-0x00000000062F4000-memory.dmp

Filesize
5.6MB

Download
memory/4668-1-0x0000000000E10000-0x0000000000EAE000-memory.dmp

Filesize
632KB

Download