08e8b75fb98b28e50863662508ed74de229fbc052923f8db05822861ae081d51

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28-01-2024 00:04

Target

7ba1d18562d7219931228d66d4d5e4d1.exe
Size

513KB
MD5

7ba1d18562d7219931228d66d4d5e4d1
SHA1

b4bd541564dc53bb38dd884c4853cdf035bc5dd5
SHA256

08e8b75fb98b28e50863662508ed74de229fbc052923f8db05822861ae081d51
SHA512

b433fbebf9b81ad42f86a1597b03eb427ac2c93b40aab73bf3eaf9df5786815782009d91d30b2234438f57b5c4cc1d7f94201e3e3d9b34b8339792a3bca697d2
SSDEEP

12288:WcgFDJ6B42I08WbtJc7vmg41KU3ZE0D1msMf+su:p8AB42I0ntJc7vmg41bRHMf+s

Score

7^/10

Loads dropped DLL 2 IoCs

Processes:

7ba1d18562d7219931228d66d4d5e4d1.exe

pid process

388 7ba1d18562d7219931228d66d4d5e4d1.exe
388 7ba1d18562d7219931228d66d4d5e4d1.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

7ba1d18562d7219931228d66d4d5e4d1.exe

description pid process target process

PID 388 set thread context of 2424 388 7ba1d18562d7219931228d66d4d5e4d1.exe 7ba1d18562d7219931228d66d4d5e4d1.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1844 2424 WerFault.exe 7ba1d18562d7219931228d66d4d5e4d1.exe

pid	process
388	7ba1d18562d7219931228d66d4d5e4d1.exe
388	7ba1d18562d7219931228d66d4d5e4d1.exe

description	pid	process	target process
PID 388 set thread context of 2424	388	7ba1d18562d7219931228d66d4d5e4d1.exe	7ba1d18562d7219931228d66d4d5e4d1.exe

pid	pid_target	process	target process
1844	2424	WerFault.exe	7ba1d18562d7219931228d66d4d5e4d1.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7ba1d18562d7219931228d66d4d5e4d1.exe

description	pid	process	target process
PID 388 wrote to memory of 2424	388	7ba1d18562d7219931228d66d4d5e4d1.exe	7ba1d18562d7219931228d66d4d5e4d1.exe
PID 388 wrote to memory of 2424	388	7ba1d18562d7219931228d66d4d5e4d1.exe	7ba1d18562d7219931228d66d4d5e4d1.exe
PID 388 wrote to memory of 2424	388	7ba1d18562d7219931228d66d4d5e4d1.exe	7ba1d18562d7219931228d66d4d5e4d1.exe
PID 388 wrote to memory of 2424	388	7ba1d18562d7219931228d66d4d5e4d1.exe	7ba1d18562d7219931228d66d4d5e4d1.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2424 -ip 2424
1⤵
PID:4332

C:\Users\Admin\AppData\Local\Temp\crypt.dll

Filesize
56KB

MD5
d848ca40948f7c464f239d96bc7c9632

SHA1
851634e1bdd7a1d286d96a3c938b4114d26dbc69

SHA256
61bedf0d2927f44da317aab4dcb0d6c9010ee6d4a8c678ece6bf90639aa74523

SHA512
66fc4da86e5b5dd693ea93fa13e44a50f15ffe14e677b39fe6cb2719a941a2cbd36bc227e63a9125a0167c99b924e82e10edad696fe8b8434811aeca93ffa763

Download Submit
memory/388-4-0x00000000005E0000-0x00000000005F7000-memory.dmp

Filesize
92KB

Download
memory/388-9-0x0000000000010000-0x000000000009B000-memory.dmp

Filesize
556KB

Download