169ebe6f5d0c7e62aff1f89c892d0caf222f52c7ec5a3e654928316af8bbba5c

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 23:24

Target

430d3f862f076ab6144851f4f8ac0f1a.exe
Size

1.1MB
MD5

430d3f862f076ab6144851f4f8ac0f1a
SHA1

df878bf7504930dc92e160404e4c3ec314bcc5cc
SHA256

169ebe6f5d0c7e62aff1f89c892d0caf222f52c7ec5a3e654928316af8bbba5c
SHA512

25898fe85f22b4e27b32e527d72b393b1b8860ca9e676045ce451428362f469b50667a86c882d71226081bce56bfc3bbe38a15f616614d7cb589cf0417d4ec3d
SSDEEP

24576:gSw4F0tAS0K5aEwPmd012bvA6BE4xTzS6B89HxxcDsc6:x9S0CZyM0KNTIdx+DsP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2584 set thread context of 3800	2584	430d3f862f076ab6144851f4f8ac0f1a.exe	89

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2548	3800	WerFault.exe	89
4496	3800	WerFault.exe	89

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 3800	2584	430d3f862f076ab6144851f4f8ac0f1a.exe	89
PID 2584 wrote to memory of 3800	2584	430d3f862f076ab6144851f4f8ac0f1a.exe	89
PID 2584 wrote to memory of 3800	2584	430d3f862f076ab6144851f4f8ac0f1a.exe	89
PID 2584 wrote to memory of 3800	2584	430d3f862f076ab6144851f4f8ac0f1a.exe	89
PID 2584 wrote to memory of 3800	2584	430d3f862f076ab6144851f4f8ac0f1a.exe	89
PID 2584 wrote to memory of 3800	2584	430d3f862f076ab6144851f4f8ac0f1a.exe	89
PID 2584 wrote to memory of 3800	2584	430d3f862f076ab6144851f4f8ac0f1a.exe	89
PID 2584 wrote to memory of 3800	2584	430d3f862f076ab6144851f4f8ac0f1a.exe	89
PID 2584 wrote to memory of 3800	2584	430d3f862f076ab6144851f4f8ac0f1a.exe	89
PID 2584 wrote to memory of 3800	2584	430d3f862f076ab6144851f4f8ac0f1a.exe	89

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3800 -ip 3800
1⤵
PID:2144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3800 -ip 3800
1⤵
PID:4284

memory/3800-0-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3800-1-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3800-2-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3800-4-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3800-3-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3800-5-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3800-6-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3800-7-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download