4b7e32eefe99af61858f3b802855c913186a8e7590d9727e66389df9b18b1e5a

Analysis

max time kernel
140s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 18:48

Target

8d14f2e35c00dffdabe1e8a1d138139f.exe
Size

159KB
MD5

8d14f2e35c00dffdabe1e8a1d138139f
SHA1

92d54039030fcfa92322e7dcacd2244d3675618d
SHA256

4b7e32eefe99af61858f3b802855c913186a8e7590d9727e66389df9b18b1e5a
SHA512

374c17ca47a4d0b7cdc5430c6a5b284cdb6d81c365c2bb7d03f93aa4bb9054cacf894abaeeed11a507a017d934c6cbfa8c650e3cff0e768bc20fa2b070d46ef0
SSDEEP

3072:kwZQ5RyoN1CAErL4X45afqiJOjA35+X/bahwWsrc:kTlXEQX4gsE+XDqdD

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
4952	8d14f2e35c00dffdabe1e8a1d138139f.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4952 set thread context of 1092	4952	8d14f2e35c00dffdabe1e8a1d138139f.exe	84

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2344	1092	WerFault.exe	84

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\ P:\1vrgKfefdfHgB3d7v7.txt	8d14f2e35c00dffdabe1e8a1d138139f.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 1092	4952	8d14f2e35c00dffdabe1e8a1d138139f.exe	84
PID 4952 wrote to memory of 1092	4952	8d14f2e35c00dffdabe1e8a1d138139f.exe	84
PID 4952 wrote to memory of 1092	4952	8d14f2e35c00dffdabe1e8a1d138139f.exe	84
PID 4952 wrote to memory of 1092	4952	8d14f2e35c00dffdabe1e8a1d138139f.exe	84
PID 4952 wrote to memory of 1092	4952	8d14f2e35c00dffdabe1e8a1d138139f.exe	84
PID 4952 wrote to memory of 1092	4952	8d14f2e35c00dffdabe1e8a1d138139f.exe	84
PID 4952 wrote to memory of 1092	4952	8d14f2e35c00dffdabe1e8a1d138139f.exe	84
PID 4952 wrote to memory of 1092	4952	8d14f2e35c00dffdabe1e8a1d138139f.exe	84
PID 4952 wrote to memory of 1092	4952	8d14f2e35c00dffdabe1e8a1d138139f.exe	84

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1092 -ip 1092
1⤵
PID:4968

C:\Users\Admin\AppData\Local\Temp\eYdW8ae54dqjE6aVew.tmp

Filesize
3KB

MD5
e2b92a2d8248319df514ebb424bf344f

SHA1
747739611d732e72382c9b56e6a83db77b07087d

SHA256
00329b987e6741d18f62d8596a5f1222893b5f28b4a0f3190c1a899ef47c8bec

SHA512
3d211e9846ff5add6459d515b603d6d5f4a40fdcc73e980161853b9ee9c8dd054dcab709864eac98f440c4dfa085207b829789efac4207c9241788553d6785be

Download Submit
memory/1092-5-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1092-7-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1092-8-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download