ba0a713877ce5762bfc9ec3d962deca82a4573cd980f96ece1e9d76239bd8bce

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06-01-2024 23:12

Target

4769e8f264cfc9500011da93780d88b1.exe
Size

366KB
MD5

4769e8f264cfc9500011da93780d88b1
SHA1

d5ee227f7f497a4cc12354e035d6ee922a4a445a
SHA256

ba0a713877ce5762bfc9ec3d962deca82a4573cd980f96ece1e9d76239bd8bce
SHA512

2987cf0701979b7b38191aafc2f0d0ad93e30d944207cb16e04515a469bed2822e0025cff70cad054812010059ad2a4a36199e9f6ee1b5b869d34eec1a8af941
SSDEEP

6144:d8cL5nzdHT6Z1iV26cqG9xWjXbH63/HmhN3SlFblO+H:bRzZTSR6zWxK+PANCBOi

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4144 set thread context of 1104	4144	4769e8f264cfc9500011da93780d88b1.exe	95

Program crash 1 IoCs

pid	pid_target	Process
860	1104	WerFault.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 1104	4144	4769e8f264cfc9500011da93780d88b1.exe	95
PID 4144 wrote to memory of 1104	4144	4769e8f264cfc9500011da93780d88b1.exe	95
PID 4144 wrote to memory of 1104	4144	4769e8f264cfc9500011da93780d88b1.exe	95
PID 4144 wrote to memory of 1104	4144	4769e8f264cfc9500011da93780d88b1.exe	95
PID 4144 wrote to memory of 1104	4144	4769e8f264cfc9500011da93780d88b1.exe	95

C:\Users\Admin\AppData\Local\Temp\4769e8f264cfc9500011da93780d88b1.exe
"C:\Users\Admin\AppData\Local\Temp\4769e8f264cfc9500011da93780d88b1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Users\Admin\AppData\Local\Temp\4769e8f264cfc9500011da93780d88b1.exe
  C:\Users\Admin\AppData\Local\Temp\4769e8f264cfc9500011da93780d88b1.exe
  2⤵
  PID:1104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1104 -ip 1104
1⤵
PID:2072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 460
1⤵
- Program crash
PID:860

memory/1104-6-0x0000000063400000-0x000000006345F000-memory.dmp

Filesize
380KB

Download
memory/1104-4-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1104-2-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/4144-0-0x0000000063400000-0x000000006345F000-memory.dmp

Filesize
380KB

Download
memory/4144-5-0x0000000063400000-0x000000006345F000-memory.dmp

Filesize
380KB

Download
memory/4144-1-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download