143f274fed7cff6f3e821ac638190999ed11f142e059b084b03f2be807534fee

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 02:32

Target

249859288b16d1c3b3f3ddc8ca98ce63.exe
Size

1.1MB
MD5

249859288b16d1c3b3f3ddc8ca98ce63
SHA1

12e6d0fdd3a2ccc9c70333c309f7a5fea3c607ab
SHA256

143f274fed7cff6f3e821ac638190999ed11f142e059b084b03f2be807534fee
SHA512

77756bd99bc7a0f266d2c214ffc66bfda0a395c7b95c108edf6e97acef914e0519b576730662ecc571e49c5332b2a4c1b5622736780ca75172ddf32583e1c019
SSDEEP

24576:/m9G36xN9G36xttgFVIRT2uvHEQbtCzAKkAjL8QAU9qDQtno3YP:/L5xWkKk4CzXgme+

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 560 set thread context of 2364	560	249859288b16d1c3b3f3ddc8ca98ce63.exe	22

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2892	2364	WerFault.exe	22
2944	2364	WerFault.exe	22

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 2364	560	249859288b16d1c3b3f3ddc8ca98ce63.exe	22
PID 560 wrote to memory of 2364	560	249859288b16d1c3b3f3ddc8ca98ce63.exe	22
PID 560 wrote to memory of 2364	560	249859288b16d1c3b3f3ddc8ca98ce63.exe	22
PID 560 wrote to memory of 2364	560	249859288b16d1c3b3f3ddc8ca98ce63.exe	22
PID 560 wrote to memory of 2364	560	249859288b16d1c3b3f3ddc8ca98ce63.exe	22
PID 560 wrote to memory of 2364	560	249859288b16d1c3b3f3ddc8ca98ce63.exe	22
PID 560 wrote to memory of 2364	560	249859288b16d1c3b3f3ddc8ca98ce63.exe	22
PID 560 wrote to memory of 2364	560	249859288b16d1c3b3f3ddc8ca98ce63.exe	22
PID 560 wrote to memory of 2364	560	249859288b16d1c3b3f3ddc8ca98ce63.exe	22
PID 560 wrote to memory of 2364	560	249859288b16d1c3b3f3ddc8ca98ce63.exe	22

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2364 -ip 2364
1⤵
PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2364 -ip 2364
1⤵
PID:116

memory/2364-1-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/2364-2-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/2364-0-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/2364-3-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/2364-4-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/2364-5-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/2364-6-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/2364-7-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download