98d7775ec0981eaa08b88a191777dc789eeb96728db909750a9ffd96d827c143

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2023, 09:33

Target

e14808468255a0635af33c8889be55caa22ee2bab8cf8da21d76882ef7f36317.exe
Size

637KB
MD5

287c003f919180e57cf66343ff47789f
SHA1

b0171d7113dea955bb8d43e05d0bd8608b7b7e6f
SHA256

e14808468255a0635af33c8889be55caa22ee2bab8cf8da21d76882ef7f36317
SHA512

05281a492cbaf7db869d5405598e876361757aabaeb7074fdb77f688d3cca816590109319ba4b35590da8fd02167ce3a0840e33ab9f25591a66527c35514d3fa
SSDEEP

12288:Erv4NLHwk9N+XhtqcpOHWZLwPone+RlE4nMzAiBvmAmNnR1/JlYK4ENzqjvK:avUzuIHW6Ae+RyDvBENzL4EN0

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3960 set thread context of 2336	3960	e14808468255a0635af33c8889be55caa22ee2bab8cf8da21d76882ef7f36317.exe	93

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2712	2336	WerFault.exe	93

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2336	e14808468255a0635af33c8889be55caa22ee2bab8cf8da21d76882ef7f36317.exe
2336	e14808468255a0635af33c8889be55caa22ee2bab8cf8da21d76882ef7f36317.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 2336	3960	e14808468255a0635af33c8889be55caa22ee2bab8cf8da21d76882ef7f36317.exe	93
PID 3960 wrote to memory of 2336	3960	e14808468255a0635af33c8889be55caa22ee2bab8cf8da21d76882ef7f36317.exe	93
PID 3960 wrote to memory of 2336	3960	e14808468255a0635af33c8889be55caa22ee2bab8cf8da21d76882ef7f36317.exe	93
PID 3960 wrote to memory of 2336	3960	e14808468255a0635af33c8889be55caa22ee2bab8cf8da21d76882ef7f36317.exe	93
PID 3960 wrote to memory of 2336	3960	e14808468255a0635af33c8889be55caa22ee2bab8cf8da21d76882ef7f36317.exe	93
PID 3960 wrote to memory of 2336	3960	e14808468255a0635af33c8889be55caa22ee2bab8cf8da21d76882ef7f36317.exe	93

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2336 -ip 2336
1⤵
PID:4892

memory/2336-11-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2336-16-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2336-15-0x00000000019F0000-0x0000000001D3A000-memory.dmp

Filesize
3.3MB

Download
memory/2336-13-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3960-4-0x0000000005A40000-0x0000000005A50000-memory.dmp

Filesize
64KB

Download
memory/3960-5-0x0000000005A30000-0x0000000005A3A000-memory.dmp

Filesize
40KB

Download
memory/3960-6-0x0000000005CA0000-0x0000000005CB8000-memory.dmp

Filesize
96KB

Download
memory/3960-7-0x0000000005CD0000-0x0000000005CD6000-memory.dmp

Filesize
24KB

Download
memory/3960-8-0x00000000032A0000-0x00000000032AA000-memory.dmp

Filesize
40KB

Download
memory/3960-9-0x0000000006ED0000-0x0000000006F4E000-memory.dmp

Filesize
504KB

Download
memory/3960-10-0x000000000BAF0000-0x000000000BB8C000-memory.dmp

Filesize
624KB

Download
memory/3960-1-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/3960-3-0x0000000005A70000-0x0000000005B02000-memory.dmp

Filesize
584KB

Download
memory/3960-14-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/3960-2-0x0000000005F80000-0x0000000006524000-memory.dmp

Filesize
5.6MB

Download
memory/3960-0-0x0000000000F90000-0x0000000001036000-memory.dmp

Filesize
664KB

Download