e72126642733836ed79620109977a2baa56343ba67a5d9883685f61ee0a268a7

Analysis

max time kernel
287s
max time network
292s
platform
windows10-1703_x64
resource
win10-20231129-en
resource tags

arch:x64arch:x86image:win10-20231129-enlocale:en-usos:windows10-1703-x64system
submitted
11/12/2023, 05:18

Target

e72126642733836ed79620109977a2baa56343ba67a5d9883685f61ee0a268a7.exe
Size

1.1MB
MD5

6984a69d5a7085d3fe479a9238c4bc54
SHA1

44fe18bc3439ee28d769b309a156ac4d03abcc70
SHA256

e72126642733836ed79620109977a2baa56343ba67a5d9883685f61ee0a268a7
SHA512

b204984efafc10c104d10f6e52c33e13410d9b1b668b0cdee10bafd1b0c9e50c8a326d86f014a840bff791783ebec848acb8f2243b1531d96c5bf3a15c834966
SSDEEP

24576:BrvpJHGfy4jWG4mFcISb1hSmQ15AGfiiR:Bd4jWG4mFcIQ1mvAGR

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1444 set thread context of 3220	1444	e72126642733836ed79620109977a2baa56343ba67a5d9883685f61ee0a268a7.exe	15

Program crash 1 IoCs

pid	pid_target	Process
4676	1444	WerFault.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 3220	1444	e72126642733836ed79620109977a2baa56343ba67a5d9883685f61ee0a268a7.exe	15
PID 1444 wrote to memory of 3220	1444	e72126642733836ed79620109977a2baa56343ba67a5d9883685f61ee0a268a7.exe	15
PID 1444 wrote to memory of 3220	1444	e72126642733836ed79620109977a2baa56343ba67a5d9883685f61ee0a268a7.exe	15
PID 1444 wrote to memory of 3220	1444	e72126642733836ed79620109977a2baa56343ba67a5d9883685f61ee0a268a7.exe	15
PID 1444 wrote to memory of 3220	1444	e72126642733836ed79620109977a2baa56343ba67a5d9883685f61ee0a268a7.exe	15
PID 1444 wrote to memory of 3220	1444	e72126642733836ed79620109977a2baa56343ba67a5d9883685f61ee0a268a7.exe	15
PID 1444 wrote to memory of 3220	1444	e72126642733836ed79620109977a2baa56343ba67a5d9883685f61ee0a268a7.exe	15
PID 1444 wrote to memory of 3220	1444	e72126642733836ed79620109977a2baa56343ba67a5d9883685f61ee0a268a7.exe	15

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
1⤵
PID:3220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 304
1⤵
- Program crash
PID:4676

memory/3220-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3220-4-0x0000000073BA0000-0x000000007428E000-memory.dmp

Filesize
6.9MB

Download
memory/3220-5-0x0000000006DB0000-0x0000000006DC0000-memory.dmp

Filesize
64KB

Download
memory/3220-8-0x0000000009340000-0x000000000944A000-memory.dmp

Filesize
1.0MB

Download
memory/3220-7-0x0000000006DC0000-0x0000000006DD2000-memory.dmp

Filesize
72KB

Download
memory/3220-9-0x0000000009270000-0x00000000092AE000-memory.dmp

Filesize
248KB

Download
memory/3220-6-0x0000000009840000-0x0000000009E46000-memory.dmp

Filesize
6.0MB

Download
memory/3220-10-0x00000000092B0000-0x00000000092FB000-memory.dmp

Filesize
300KB

Download
memory/3220-27-0x0000000073BA0000-0x000000007428E000-memory.dmp

Filesize
6.9MB

Download
memory/3220-34-0x0000000006DB0000-0x0000000006DC0000-memory.dmp

Filesize
64KB

Download