e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933

Analysis

max time kernel
162s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2023 16:45

Target

e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe
Size

941KB
MD5

00e2bb2624c734506abe9d2c5bd89ade
SHA1

fe9ce13b890558a8c85c88cddafdc07fc943012b
SHA256

e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933
SHA512

9f750b7256fbef4e10c4566505c7482df14087550f7772bd6dafee450852d148f59815e6dcac51e7e6086c4a7f6d6d9e19a26baa43c6e5af0413402b221ff895
SSDEEP

24576:SFtD/619Y/FCmKv9XHzrxHoojg6RDJ23wHENt:q6b6FC31HxFcWUr

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2500 set thread context of 4232	2500	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	96

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1460	4232	WerFault.exe	96

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4232	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe
4232	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 4232	2500	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	96
PID 2500 wrote to memory of 4232	2500	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	96
PID 2500 wrote to memory of 4232	2500	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	96
PID 2500 wrote to memory of 4232	2500	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	96
PID 2500 wrote to memory of 4232	2500	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	96
PID 2500 wrote to memory of 4232	2500	e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933.exe	96

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4232 -ip 4232
1⤵
PID:3352

memory/2500-8-0x0000000005190000-0x00000000051A8000-memory.dmp

Filesize
96KB

Download
memory/2500-6-0x0000000000AE0000-0x0000000000AEA000-memory.dmp

Filesize
40KB

Download
memory/2500-2-0x0000000005280000-0x0000000005824000-memory.dmp

Filesize
5.6MB

Download
memory/2500-3-0x0000000074660000-0x0000000074E10000-memory.dmp

Filesize
7.7MB

Download
memory/2500-0-0x0000000074660000-0x0000000074E10000-memory.dmp

Filesize
7.7MB

Download
memory/2500-5-0x0000000004F20000-0x0000000004F30000-memory.dmp

Filesize
64KB

Download
memory/2500-1-0x0000000000130000-0x0000000000222000-memory.dmp

Filesize
968KB

Download
memory/2500-7-0x0000000004F20000-0x0000000004F30000-memory.dmp

Filesize
64KB

Download
memory/2500-4-0x0000000004C10000-0x0000000004CA2000-memory.dmp

Filesize
584KB

Download
memory/2500-9-0x00000000051C0000-0x00000000051C6000-memory.dmp

Filesize
24KB

Download
memory/2500-10-0x0000000000600000-0x000000000060A000-memory.dmp

Filesize
40KB

Download
memory/2500-11-0x0000000000C70000-0x0000000000CEE000-memory.dmp

Filesize
504KB

Download
memory/2500-12-0x000000000F1C0000-0x000000000F25C000-memory.dmp

Filesize
624KB

Download
memory/2500-16-0x0000000074660000-0x0000000074E10000-memory.dmp

Filesize
7.7MB

Download
memory/4232-15-0x0000000001170000-0x00000000014BA000-memory.dmp

Filesize
3.3MB

Download
memory/4232-13-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download