39a782015a3fd6125581719350115a91d3ab461772bf55cd03121dcaf22b5100

Analysis

max time kernel
162s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 03:55

Target

271f20810b3bde2aea977e58adcf664a.exe
Size

43KB
MD5

271f20810b3bde2aea977e58adcf664a
SHA1

b190e2587997f076b58cc87da87d8c85723d50cf
SHA256

39a782015a3fd6125581719350115a91d3ab461772bf55cd03121dcaf22b5100
SHA512

d6bd0603c3afda37379cff28aa5c20a8102945b5c69a839712e0b161a157c1f95ffdce870cc81b3d3ea2f9ac4967e50b542a5cc2b234cbc5796196e981774c0b
SSDEEP

768:RJSr21Uis2hxFL07zYZuZPWVxcI77OMaF2IT9ala22MBdWjEyZpV+kjS29TbtX:R42S6wAiWVxRroT9ala22MHWjEyp+0lV

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2972 set thread context of 2408	2972	271f20810b3bde2aea977e58adcf664a.exe	91

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2408	271f20810b3bde2aea977e58adcf664a.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2408	2972	271f20810b3bde2aea977e58adcf664a.exe	91
PID 2972 wrote to memory of 2408	2972	271f20810b3bde2aea977e58adcf664a.exe	91
PID 2972 wrote to memory of 2408	2972	271f20810b3bde2aea977e58adcf664a.exe	91
PID 2972 wrote to memory of 2408	2972	271f20810b3bde2aea977e58adcf664a.exe	91
PID 2972 wrote to memory of 2408	2972	271f20810b3bde2aea977e58adcf664a.exe	91
PID 2972 wrote to memory of 2408	2972	271f20810b3bde2aea977e58adcf664a.exe	91
PID 2972 wrote to memory of 2408	2972	271f20810b3bde2aea977e58adcf664a.exe	91
PID 2972 wrote to memory of 2408	2972	271f20810b3bde2aea977e58adcf664a.exe	91

C:\Users\Admin\AppData\Local\Temp\271f20810b3bde2aea977e58adcf664a.exe
"C:\Users\Admin\AppData\Local\Temp\271f20810b3bde2aea977e58adcf664a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Local\Temp\271f20810b3bde2aea977e58adcf664a.exe
  "C:\Users\Admin\AppData\Local\Temp\271f20810b3bde2aea977e58adcf664a.exe"
  2⤵
  - Suspicious use of UnmapMainImage
  PID:2408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2408 -ip 2408
1⤵
PID:4004

memory/2408-0-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2408-1-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2408-2-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2972-4-0x0000000000010000-0x0000000000022000-memory.dmp

Filesize
72KB

Download