7b90e51f5cb7828779c97681d5879c54e5e93bcad9bfac34d17efc6a8efab38a

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 01:18

Target

3f8865613b4aec2dab5388f4e4676882.exe
Size

451KB
MD5

3f8865613b4aec2dab5388f4e4676882
SHA1

e74f798128251d5d4484c83e54e68deec3d6ef2e
SHA256

7b90e51f5cb7828779c97681d5879c54e5e93bcad9bfac34d17efc6a8efab38a
SHA512

e5a723aa1b501074ad2419fa70629b852ab470e7f32243f91f408d38c1b6638cc137395a4b9b4ede084b638e4ace58f8f89633fd0116e2ac97df47cd1694fe99
SSDEEP

12288:tYMEGdAYnaa+SSOlE1NdNAgv4MOb4bIzRsTXfXCMOW:iAAYnBxBE1NdOgvwbGIzRsTXqMh

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4364 set thread context of 3376	4364	3f8865613b4aec2dab5388f4e4676882.exe	25

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1836	4364	WerFault.exe	15
4036	3376	WerFault.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 3376	4364	3f8865613b4aec2dab5388f4e4676882.exe	25
PID 4364 wrote to memory of 3376	4364	3f8865613b4aec2dab5388f4e4676882.exe	25
PID 4364 wrote to memory of 3376	4364	3f8865613b4aec2dab5388f4e4676882.exe	25
PID 4364 wrote to memory of 3376	4364	3f8865613b4aec2dab5388f4e4676882.exe	25
PID 4364 wrote to memory of 3376	4364	3f8865613b4aec2dab5388f4e4676882.exe	25

C:\Users\Admin\AppData\Local\Temp\3f8865613b4aec2dab5388f4e4676882.exe
"C:\Users\Admin\AppData\Local\Temp\3f8865613b4aec2dab5388f4e4676882.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 480
  2⤵
  - Program crash
  PID:1836
- C:\Users\Admin\AppData\Local\Temp\3f8865613b4aec2dab5388f4e4676882.exe
  C:\Users\Admin\AppData\Local\Temp\3f8865613b4aec2dab5388f4e4676882.exe
  2⤵
  PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3376 -ip 3376
1⤵
PID:116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4364 -ip 4364
1⤵
PID:3784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 460
1⤵
- Program crash
PID:4036

memory/3376-3-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/3376-1-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/4364-0-0x0000000002070000-0x0000000002071000-memory.dmp

Filesize
4KB

Download
memory/4364-4-0x0000000010000000-0x0000000010079000-memory.dmp

Filesize
484KB

Download