86deb31a7de43c749f51d77f70e0252a95df5bf9cf571f211292f2b1a798f4a4

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 05:49

Target

796f68d8c78e2d9d395e17750bb0d633.exe
Size

186KB
MD5

796f68d8c78e2d9d395e17750bb0d633
SHA1

6d49f9d3328d8ba6cabb3bed298bee843e448a83
SHA256

86deb31a7de43c749f51d77f70e0252a95df5bf9cf571f211292f2b1a798f4a4
SHA512

a3abcb9f3d35ed3a10e37895420e85e9a78b599a4d0a51e75726dfa71b27176f9097ab1ceee1fd8466d77047d713e7321541cae89728e95a2de4a285af2c0540
SSDEEP

3072:rsWebxAU4VorEo6Le2EVShzSXH3G5IX/diJ6yTwHnVlCFzL3KsSqb:rLebuUHeEXoI1ikyTEPCFzL3KW

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3028 set thread context of 1788	3028	796f68d8c78e2d9d395e17750bb0d633.exe	92

Program crash 1 IoCs

pid	pid_target	Process
2096	1788	WerFault.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 1788	3028	796f68d8c78e2d9d395e17750bb0d633.exe	92
PID 3028 wrote to memory of 1788	3028	796f68d8c78e2d9d395e17750bb0d633.exe	92
PID 3028 wrote to memory of 1788	3028	796f68d8c78e2d9d395e17750bb0d633.exe	92
PID 3028 wrote to memory of 1788	3028	796f68d8c78e2d9d395e17750bb0d633.exe	92
PID 3028 wrote to memory of 1788	3028	796f68d8c78e2d9d395e17750bb0d633.exe	92
PID 3028 wrote to memory of 1788	3028	796f68d8c78e2d9d395e17750bb0d633.exe	92
PID 3028 wrote to memory of 1788	3028	796f68d8c78e2d9d395e17750bb0d633.exe	92
PID 3028 wrote to memory of 1788	3028	796f68d8c78e2d9d395e17750bb0d633.exe	92
PID 3028 wrote to memory of 1788	3028	796f68d8c78e2d9d395e17750bb0d633.exe	92
PID 3028 wrote to memory of 1788	3028	796f68d8c78e2d9d395e17750bb0d633.exe	92

C:\Users\Admin\AppData\Local\Temp\796f68d8c78e2d9d395e17750bb0d633.exe
"C:\Users\Admin\AppData\Local\Temp\796f68d8c78e2d9d395e17750bb0d633.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\796f68d8c78e2d9d395e17750bb0d633.exe
  "C:\Users\Admin\AppData\Local\Temp\796f68d8c78e2d9d395e17750bb0d633.exe"
  2⤵
  PID:1788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1788 -ip 1788
1⤵
PID:1220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 12
1⤵
- Program crash
PID:2096

memory/1788-3-0x00000000000C0000-0x000000000011C000-memory.dmp

Filesize
368KB

Download
memory/1788-2-0x00000000000C0000-0x000000000011C000-memory.dmp

Filesize
368KB

Download
memory/1788-1-0x00000000000C0000-0x000000000011C000-memory.dmp

Filesize
368KB

Download
memory/1788-0-0x00000000000C0000-0x000000000011C000-memory.dmp

Filesize
368KB

Download
memory/3028-6-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download