5a226e5207d7ea2c0e14abb068268a55bc974bdfe17181f6982b92a0a7fedcf2

Analysis

max time kernel
21s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2023 05:03

Target

c5bc645f578d60725e7c38b3ef9c8352.exe
Size

500KB
MD5

c5bc645f578d60725e7c38b3ef9c8352
SHA1

c1933c1befcd21acc807991c2d0de2e3637988b5
SHA256

5a226e5207d7ea2c0e14abb068268a55bc974bdfe17181f6982b92a0a7fedcf2
SHA512

9c07208f081f828becc0091232e908a7efa744647541f599d874e22a8b1b0a5297d4044c201996809af6fb17836bc2c0dc91671a528083f213a8b0202fffd1d6
SSDEEP

12288:xcgBxxOZuX86JY1oowOZ6XxAiVrjJgostVHUdG:1s8XfeXv6T7YH0dG

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

c5bc645f578d60725e7c38b3ef9c8352.exe

description pid process target process

PID 4856 set thread context of 2456 4856 c5bc645f578d60725e7c38b3ef9c8352.exe c5bc645f578d60725e7c38b3ef9c8352.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3736 2456 WerFault.exe c5bc645f578d60725e7c38b3ef9c8352.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c5bc645f578d60725e7c38b3ef9c8352.exe

description pid process

Token: SeDebugPrivilege 4856 c5bc645f578d60725e7c38b3ef9c8352.exe

description	pid	process	target process
PID 4856 set thread context of 2456	4856	c5bc645f578d60725e7c38b3ef9c8352.exe	c5bc645f578d60725e7c38b3ef9c8352.exe

pid	pid_target	process	target process
3736	2456	WerFault.exe	c5bc645f578d60725e7c38b3ef9c8352.exe

description	pid	process
Token: SeDebugPrivilege	4856	c5bc645f578d60725e7c38b3ef9c8352.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

c5bc645f578d60725e7c38b3ef9c8352.exe

description	pid	process	target process
PID 4856 wrote to memory of 2456	4856	c5bc645f578d60725e7c38b3ef9c8352.exe	c5bc645f578d60725e7c38b3ef9c8352.exe
PID 4856 wrote to memory of 2456	4856	c5bc645f578d60725e7c38b3ef9c8352.exe	c5bc645f578d60725e7c38b3ef9c8352.exe
PID 4856 wrote to memory of 2456	4856	c5bc645f578d60725e7c38b3ef9c8352.exe	c5bc645f578d60725e7c38b3ef9c8352.exe
PID 4856 wrote to memory of 2456	4856	c5bc645f578d60725e7c38b3ef9c8352.exe	c5bc645f578d60725e7c38b3ef9c8352.exe
PID 4856 wrote to memory of 2456	4856	c5bc645f578d60725e7c38b3ef9c8352.exe	c5bc645f578d60725e7c38b3ef9c8352.exe
PID 4856 wrote to memory of 2456	4856	c5bc645f578d60725e7c38b3ef9c8352.exe	c5bc645f578d60725e7c38b3ef9c8352.exe
PID 4856 wrote to memory of 2456	4856	c5bc645f578d60725e7c38b3ef9c8352.exe	c5bc645f578d60725e7c38b3ef9c8352.exe
PID 4856 wrote to memory of 2456	4856	c5bc645f578d60725e7c38b3ef9c8352.exe	c5bc645f578d60725e7c38b3ef9c8352.exe

C:\Users\Admin\AppData\Local\Temp\c5bc645f578d60725e7c38b3ef9c8352.exe
C:\Users\Admin\AppData\Local\Temp\c5bc645f578d60725e7c38b3ef9c8352.exe
2⤵
PID:2456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 1204
3⤵
- Program crash
PID:3736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2456 -ip 2456
1⤵
PID:2148

memory/2456-9-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2456-11-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2456-8-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2456-6-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2456-21-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4856-1-0x00000000744A0000-0x0000000074C50000-memory.dmp

Filesize
7.7MB

Download
memory/4856-0-0x00000000003F0000-0x0000000000470000-memory.dmp

Filesize
512KB

Download
memory/4856-2-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/4856-3-0x0000000004DE0000-0x0000000004DF4000-memory.dmp

Filesize
80KB

Download
memory/4856-4-0x0000000004E80000-0x0000000004EF6000-memory.dmp

Filesize
472KB

Download
memory/4856-5-0x0000000004E50000-0x0000000004E6E000-memory.dmp

Filesize
120KB

Download
memory/4856-10-0x00000000744A0000-0x0000000074C50000-memory.dmp

Filesize
7.7MB

Download