e25a08b9c2e12a9a28e7d3b8c8118127ccc5a73668f8b053113b6918b42ebd04

Analysis

max time kernel
145s
max time network
77s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2024 06:26

Target

tmp.exe
Size

664KB
MD5

343863843ccaeb8ecea99adb6311ff91
SHA1

e526e5dcfddead88826609d05c33cc3146d9330f
SHA256

e25a08b9c2e12a9a28e7d3b8c8118127ccc5a73668f8b053113b6918b42ebd04
SHA512

02647e299a1655fb5fe5cb7cc6c902e0042a89aa748629e94f661ca5b276c9819f319d8ae12b42a213587bbad6a0aca5ec04c6a38365bdb2e99a54109863e723
SSDEEP

12288:ZOAbfhJqopmqZY9OLt/5ZxAT15CjUYcT1WEtUxl:ZjEoUGLLt/VS15b11WE

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2896 set thread context of 32	2896	tmp.exe	19

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4416	32	WerFault.exe	19
804	32	WerFault.exe	19

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 32	2896	tmp.exe	19
PID 2896 wrote to memory of 32	2896	tmp.exe	19
PID 2896 wrote to memory of 32	2896	tmp.exe	19
PID 2896 wrote to memory of 32	2896	tmp.exe	19
PID 2896 wrote to memory of 32	2896	tmp.exe	19
PID 2896 wrote to memory of 32	2896	tmp.exe	19
PID 2896 wrote to memory of 32	2896	tmp.exe	19
PID 2896 wrote to memory of 32	2896	tmp.exe	19
PID 2896 wrote to memory of 32	2896	tmp.exe	19

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 32 -ip 32
1⤵
PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 32 -ip 32
1⤵
PID:1192

memory/32-4-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/32-8-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/32-12-0x0000000001380000-0x00000000013B2000-memory.dmp

Filesize
200KB

Download
memory/32-13-0x0000000001380000-0x00000000013B2000-memory.dmp

Filesize
200KB

Download
memory/32-10-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/32-14-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2896-1-0x0000000074D30000-0x00000000754E0000-memory.dmp

Filesize
7.7MB

Download
memory/2896-2-0x0000000004E30000-0x0000000004E40000-memory.dmp

Filesize
64KB

Download
memory/2896-0-0x0000000000350000-0x00000000003FC000-memory.dmp

Filesize
688KB

Download
memory/2896-11-0x0000000074D30000-0x00000000754E0000-memory.dmp

Filesize
7.7MB

Download
memory/2896-5-0x0000000005440000-0x0000000005441000-memory.dmp

Filesize
4KB

Download
memory/2896-3-0x0000000005440000-0x0000000005441000-memory.dmp

Filesize
4KB

Download