135e76a84c818748b05935b45bd8db0733cb714178315fdf784677ddfad69ee8

Analysis

max time kernel
146s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 22:33

Target

160e288f9c513527b9557dfeceea0310.exe
Size

1.3MB
MD5

160e288f9c513527b9557dfeceea0310
SHA1

2f6136ed0822f852ad22fb4f9ca60ff3f422a59d
SHA256

135e76a84c818748b05935b45bd8db0733cb714178315fdf784677ddfad69ee8
SHA512

35f0c0cb2cbc602283c0a3eaf57b2b19cf1a1feb6b3e46796141bb2f245198ee4692697416b0da4094285dc89218bbe34263b62b7ff4a135b0c74dc238e29eb4
SSDEEP

24576:Ouq2tmafPHRCOfLIRT26ULQX+llih7yzs905h0OsYOl9ooM3hGrBswDNg7:UaHPixOa9puz

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3952 set thread context of 2480	3952	160e288f9c513527b9557dfeceea0310.exe	25

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3944	2480	WerFault.exe	25
3848	2480	WerFault.exe	25

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 2480	3952	160e288f9c513527b9557dfeceea0310.exe	25
PID 3952 wrote to memory of 2480	3952	160e288f9c513527b9557dfeceea0310.exe	25
PID 3952 wrote to memory of 2480	3952	160e288f9c513527b9557dfeceea0310.exe	25
PID 3952 wrote to memory of 2480	3952	160e288f9c513527b9557dfeceea0310.exe	25
PID 3952 wrote to memory of 2480	3952	160e288f9c513527b9557dfeceea0310.exe	25
PID 3952 wrote to memory of 2480	3952	160e288f9c513527b9557dfeceea0310.exe	25
PID 3952 wrote to memory of 2480	3952	160e288f9c513527b9557dfeceea0310.exe	25
PID 3952 wrote to memory of 2480	3952	160e288f9c513527b9557dfeceea0310.exe	25
PID 3952 wrote to memory of 2480	3952	160e288f9c513527b9557dfeceea0310.exe	25
PID 3952 wrote to memory of 2480	3952	160e288f9c513527b9557dfeceea0310.exe	25

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2480 -ip 2480
1⤵
PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2480 -ip 2480
1⤵
PID:4576

memory/2480-1-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/2480-3-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/2480-4-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/2480-5-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/2480-6-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/2480-2-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/2480-0-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/2480-7-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download