1672dcc672fc732638b8aef743a1b811816d14453941c456fa8583b09be0971f

Analysis

max time kernel
136s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-03-2024 08:54

Target

b85508627a621180da7c2b8adea768db.exe
Size

1.3MB
MD5

b85508627a621180da7c2b8adea768db
SHA1

9047d8c85896d77795876cbd899e5f6a29cfb1a1
SHA256

1672dcc672fc732638b8aef743a1b811816d14453941c456fa8583b09be0971f
SHA512

1fd61689c0610a234b87421b403704676adf95a06af06259a8797a493743f18a79101cad690c6f42bca49685b014bcb8e31da6bf27593ef96b6901bae0acdc5c
SSDEEP

24576:DssvOxBnSZWbYZCfOf/6XSIgmdofIaZnRbkY+kOd:DKSZWJfOH6pDdofIa/xw

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3916 set thread context of 1636	3916	b85508627a621180da7c2b8adea768db.exe	89

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4964	1636	WerFault.exe	89
4424	1636	WerFault.exe	89

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 1636	3916	b85508627a621180da7c2b8adea768db.exe	89
PID 3916 wrote to memory of 1636	3916	b85508627a621180da7c2b8adea768db.exe	89
PID 3916 wrote to memory of 1636	3916	b85508627a621180da7c2b8adea768db.exe	89
PID 3916 wrote to memory of 1636	3916	b85508627a621180da7c2b8adea768db.exe	89
PID 3916 wrote to memory of 1636	3916	b85508627a621180da7c2b8adea768db.exe	89
PID 3916 wrote to memory of 1636	3916	b85508627a621180da7c2b8adea768db.exe	89
PID 3916 wrote to memory of 1636	3916	b85508627a621180da7c2b8adea768db.exe	89
PID 3916 wrote to memory of 1636	3916	b85508627a621180da7c2b8adea768db.exe	89
PID 3916 wrote to memory of 1636	3916	b85508627a621180da7c2b8adea768db.exe	89
PID 3916 wrote to memory of 1636	3916	b85508627a621180da7c2b8adea768db.exe	89

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1636 -ip 1636
1⤵
PID:2944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1636 -ip 1636
1⤵
PID:4692

memory/1636-0-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1636-1-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1636-2-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1636-3-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1636-4-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1636-5-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1636-6-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1636-7-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download