67be6b96f6c8ecddfa93025158b661384968b37bdd2bc59b4da1639543d81145

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 12:44

Target

36936bc089bb7efa8f96c84ecda811db.exe
Size

40KB
MD5

36936bc089bb7efa8f96c84ecda811db
SHA1

de7efd50828f6376fbf9210bda790df2229f53e0
SHA256

67be6b96f6c8ecddfa93025158b661384968b37bdd2bc59b4da1639543d81145
SHA512

5ce0795a052959b4a7922523ab97cd553f68f6e242cf8210cadba2e1ff4c6107e193718f65e8a50d5e2968182c5fefc096c3c515ca0be396dfcf165347de8951
SSDEEP

768:MNtr3+zGdMx5Zdj3nr5dqgabJ9Kv0lHYkclfn:c+YMx5Zd3NA3t4v0CP/

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Deleteme.bat	36936bc089bb7efa8f96c84ecda811db.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 776 set thread context of 3308	776	36936bc089bb7efa8f96c84ecda811db.exe	38

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1376	776	WerFault.exe	14
2492	3308	WerFault.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 3308	776	36936bc089bb7efa8f96c84ecda811db.exe	38
PID 776 wrote to memory of 3308	776	36936bc089bb7efa8f96c84ecda811db.exe	38
PID 776 wrote to memory of 3308	776	36936bc089bb7efa8f96c84ecda811db.exe	38
PID 776 wrote to memory of 3308	776	36936bc089bb7efa8f96c84ecda811db.exe	38
PID 776 wrote to memory of 3308	776	36936bc089bb7efa8f96c84ecda811db.exe	38
PID 776 wrote to memory of 1156	776	36936bc089bb7efa8f96c84ecda811db.exe	36
PID 776 wrote to memory of 1156	776	36936bc089bb7efa8f96c84ecda811db.exe	36
PID 776 wrote to memory of 1156	776	36936bc089bb7efa8f96c84ecda811db.exe	36

C:\Users\Admin\AppData\Local\Temp\36936bc089bb7efa8f96c84ecda811db.exe
"C:\Users\Admin\AppData\Local\Temp\36936bc089bb7efa8f96c84ecda811db.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 220
  2⤵
  - Program crash
  PID:1376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
  2⤵
  PID:1156
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  PID:3308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 776 -ip 776
1⤵
PID:2340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 12
1⤵
- Program crash
PID:2492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3308 -ip 3308
1⤵
PID:3900

memory/776-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/776-4-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/3308-1-0x00000000006A0000-0x00000000006B3000-memory.dmp

Filesize
76KB

Download