79e58125575f22f1ac308706256ccbc097f4dffb195a8a043f486c5591e71d63

Analysis

max time kernel
147s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 15:47

Target

7a07c03fe7ffc9a5b6271b50ffff7a0d.exe
Size

57KB
MD5

7a07c03fe7ffc9a5b6271b50ffff7a0d
SHA1

7d1c8c668f0a5dc8c1ae27f82d3f2f5e24a1c83b
SHA256

79e58125575f22f1ac308706256ccbc097f4dffb195a8a043f486c5591e71d63
SHA512

47b22e05f1817982ce087b4aed486b83b0e2425df5679e22dc709a99bcabde99edad670acca7e0540069371f23fe8602c59e000f173b37f80c50e5f583684c23
SSDEEP

1536:cxYaZ+H31sbydP3zAn97yZ9Wpcp9pfbbcS0GjTY:cxYZibkA2+cJv9U

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4828 set thread context of 4944	4828	7a07c03fe7ffc9a5b6271b50ffff7a0d.exe	95

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3060	4828	WerFault.exe	30

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 4944	4828	7a07c03fe7ffc9a5b6271b50ffff7a0d.exe	95
PID 4828 wrote to memory of 4944	4828	7a07c03fe7ffc9a5b6271b50ffff7a0d.exe	95
PID 4828 wrote to memory of 4944	4828	7a07c03fe7ffc9a5b6271b50ffff7a0d.exe	95
PID 4828 wrote to memory of 4944	4828	7a07c03fe7ffc9a5b6271b50ffff7a0d.exe	95
PID 4828 wrote to memory of 4944	4828	7a07c03fe7ffc9a5b6271b50ffff7a0d.exe	95
PID 4944 wrote to memory of 3520	4944	7a07c03fe7ffc9a5b6271b50ffff7a0d.exe	43
PID 4944 wrote to memory of 3520	4944	7a07c03fe7ffc9a5b6271b50ffff7a0d.exe	43
PID 4944 wrote to memory of 3520	4944	7a07c03fe7ffc9a5b6271b50ffff7a0d.exe	43
PID 4944 wrote to memory of 3520	4944	7a07c03fe7ffc9a5b6271b50ffff7a0d.exe	43

C:\Users\Admin\AppData\Local\Temp\7a07c03fe7ffc9a5b6271b50ffff7a0d.exe
"C:\Users\Admin\AppData\Local\Temp\7a07c03fe7ffc9a5b6271b50ffff7a0d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 508
  2⤵
  - Program crash
  PID:3060
- C:\Users\Admin\AppData\Local\Temp\7a07c03fe7ffc9a5b6271b50ffff7a0d.exe
  "C:\Users\Admin\AppData\Local\Temp\7a07c03fe7ffc9a5b6271b50ffff7a0d.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 4828 -ip 4828
1⤵
PID:4216

memory/3520-1-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3520-3-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/4944-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4944-2-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4944-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download