caba116ebdaebedcd2a2ebc44f85b64e469d8d0f87cff023cae0789492004206

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2024 02:19

Target

57babd99dfbf6248640d5eae61f88458.exe
Size

51KB
MD5

57babd99dfbf6248640d5eae61f88458
SHA1

34bd8eed2215cca362a31a1e0ae3f434d2a34aa0
SHA256

caba116ebdaebedcd2a2ebc44f85b64e469d8d0f87cff023cae0789492004206
SHA512

196bac3c92129987790abed041dc23f61d48bf1c81436473a0e7ebcabd7bfd060718fe1cb8967694cfcd931b4b78c558fd5508c15fc80d01f4007a62607276fb
SSDEEP

768:pI07zQ0IAtXXAGmAo/8ceBi4d3IalnPZk/Lpd1JCmXrz4UwtlWhwlpdtgSS:pIsjIIHRo/JeBi4JdGpgGhj+pgSS

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5096 set thread context of 4884	5096	57babd99dfbf6248640d5eae61f88458.exe	94

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1152	5096	WerFault.exe	22

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 4884	5096	57babd99dfbf6248640d5eae61f88458.exe	94
PID 5096 wrote to memory of 4884	5096	57babd99dfbf6248640d5eae61f88458.exe	94
PID 5096 wrote to memory of 4884	5096	57babd99dfbf6248640d5eae61f88458.exe	94
PID 5096 wrote to memory of 4884	5096	57babd99dfbf6248640d5eae61f88458.exe	94
PID 5096 wrote to memory of 4884	5096	57babd99dfbf6248640d5eae61f88458.exe	94
PID 5096 wrote to memory of 4884	5096	57babd99dfbf6248640d5eae61f88458.exe	94
PID 4884 wrote to memory of 3448	4884	57babd99dfbf6248640d5eae61f88458.exe	47
PID 4884 wrote to memory of 3448	4884	57babd99dfbf6248640d5eae61f88458.exe	47
PID 4884 wrote to memory of 3448	4884	57babd99dfbf6248640d5eae61f88458.exe	47
PID 4884 wrote to memory of 3448	4884	57babd99dfbf6248640d5eae61f88458.exe	47

C:\Users\Admin\AppData\Local\Temp\57babd99dfbf6248640d5eae61f88458.exe
"C:\Users\Admin\AppData\Local\Temp\57babd99dfbf6248640d5eae61f88458.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 252
  2⤵
  - Program crash
  PID:1152
- C:\Users\Admin\AppData\Local\Temp\57babd99dfbf6248640d5eae61f88458.exe
  C:\Users\Admin\AppData\Local\Temp\57babd99dfbf6248640d5eae61f88458.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5096 -ip 5096
1⤵
PID:3116

memory/3448-5-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3448-6-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/4884-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4884-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4884-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4884-4-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4884-11-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4884-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download