d801b852dbc81c78360f91a305961c5ebdb6e47df32fc20e64cb5d3dc19d10fc

Analysis

max time kernel
138s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03-02-2024 08:52

Target

8bea899ee7308e3fa0030fcf9115106a.exe
Size

92KB
MD5

8bea899ee7308e3fa0030fcf9115106a
SHA1

7c776512e7fee15a6cf62ef0398f67b2cb65cadf
SHA256

d801b852dbc81c78360f91a305961c5ebdb6e47df32fc20e64cb5d3dc19d10fc
SHA512

8a663ccec9aec9f97e6662d96a051e4a8a3969ca6d14bd60f3f007fc7db2c192bae9f644ded6c57d1517069cf861368466e3ff208a4f65a647df687bb75fa348
SSDEEP

1536:/tgQloLYPNqYrlHEtsvm1f9FOt6/GoxdtnglJMAlX2EVdlBeUxpra8iL89Oiw+Md:VgQFPsElktQu9Fs6/G4dVVC2EblZraR3

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

8bea899ee7308e3fa0030fcf9115106a.exe

description pid process target process

PID 228 set thread context of 5028 228 8bea899ee7308e3fa0030fcf9115106a.exe 8bea899ee7308e3fa0030fcf9115106a.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3720 5028 WerFault.exe 8bea899ee7308e3fa0030fcf9115106a.exe

description	pid	process	target process
PID 228 set thread context of 5028	228	8bea899ee7308e3fa0030fcf9115106a.exe	8bea899ee7308e3fa0030fcf9115106a.exe

pid	pid_target	process	target process
3720	5028	WerFault.exe	8bea899ee7308e3fa0030fcf9115106a.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

8bea899ee7308e3fa0030fcf9115106a.exe

description	pid	process	target process
PID 228 wrote to memory of 5028	228	8bea899ee7308e3fa0030fcf9115106a.exe	8bea899ee7308e3fa0030fcf9115106a.exe
PID 228 wrote to memory of 5028	228	8bea899ee7308e3fa0030fcf9115106a.exe	8bea899ee7308e3fa0030fcf9115106a.exe
PID 228 wrote to memory of 5028	228	8bea899ee7308e3fa0030fcf9115106a.exe	8bea899ee7308e3fa0030fcf9115106a.exe
PID 228 wrote to memory of 5028	228	8bea899ee7308e3fa0030fcf9115106a.exe	8bea899ee7308e3fa0030fcf9115106a.exe
PID 228 wrote to memory of 5028	228	8bea899ee7308e3fa0030fcf9115106a.exe	8bea899ee7308e3fa0030fcf9115106a.exe
PID 228 wrote to memory of 5028	228	8bea899ee7308e3fa0030fcf9115106a.exe	8bea899ee7308e3fa0030fcf9115106a.exe
PID 228 wrote to memory of 5028	228	8bea899ee7308e3fa0030fcf9115106a.exe	8bea899ee7308e3fa0030fcf9115106a.exe
PID 228 wrote to memory of 5028	228	8bea899ee7308e3fa0030fcf9115106a.exe	8bea899ee7308e3fa0030fcf9115106a.exe

C:\Users\Admin\AppData\Local\Temp\8bea899ee7308e3fa0030fcf9115106a.exe
"C:\Users\Admin\AppData\Local\Temp\8bea899ee7308e3fa0030fcf9115106a.exe"
2⤵
PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 364
3⤵
- Program crash
PID:3720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5028 -ip 5028
1⤵
PID:3004

memory/5028-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/5028-2-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/5028-1-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/5028-3-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download