46ef85b7ba1c318ad626e209400e738b878e218f6a25dc46bfbea4038831dce5

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 02:36

Target

790e12d0411dc947f0370d476830424a.exe
Size

68KB
MD5

790e12d0411dc947f0370d476830424a
SHA1

1830cbb0e9e7d81f7deabf622a9a619f73540e39
SHA256

46ef85b7ba1c318ad626e209400e738b878e218f6a25dc46bfbea4038831dce5
SHA512

c0de729dc3fe1a36a254738905e69a3d1a73f0046320356bcb7657fc69c600795527f47086d164ed484dab985e587d724750f1ff53548e5c7bbbf3088b7c97b6
SSDEEP

768:V/kichnndZQefxpeMwd1Jg5Y7wWLBPJpXSKgLBPRXj:1kic1ndZQefYlg5UwWVBpXSKgVZXj

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 636 set thread context of 4052	636	790e12d0411dc947f0370d476830424a.exe	85

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2636	636	WerFault.exe	78

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
636	790e12d0411dc947f0370d476830424a.exe
4052	790e12d0411dc947f0370d476830424a.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 4052	636	790e12d0411dc947f0370d476830424a.exe	85
PID 636 wrote to memory of 4052	636	790e12d0411dc947f0370d476830424a.exe	85
PID 636 wrote to memory of 4052	636	790e12d0411dc947f0370d476830424a.exe	85
PID 636 wrote to memory of 4052	636	790e12d0411dc947f0370d476830424a.exe	85
PID 636 wrote to memory of 4052	636	790e12d0411dc947f0370d476830424a.exe	85
PID 636 wrote to memory of 4052	636	790e12d0411dc947f0370d476830424a.exe	85
PID 636 wrote to memory of 4052	636	790e12d0411dc947f0370d476830424a.exe	85
PID 636 wrote to memory of 4052	636	790e12d0411dc947f0370d476830424a.exe	85

C:\Users\Admin\AppData\Local\Temp\790e12d0411dc947f0370d476830424a.exe
"C:\Users\Admin\AppData\Local\Temp\790e12d0411dc947f0370d476830424a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:636
- C:\Users\Admin\AppData\Local\Temp\790e12d0411dc947f0370d476830424a.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 480
  2⤵
  - Program crash
  PID:2636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 636 -ip 636
1⤵
PID:4488

memory/4052-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4052-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4052-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4052-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download