72f728eb10da4c23a6f8d7cb2e22fbc5f2dac6090a71c0511a0d5c0f6ba93e2a

Analysis

max time kernel
162s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 20:31

Target

72f728eb10da4c23a6f8d7cb2e22fbc5f2dac6090a71c0511a0d5c0f6ba93e2a.exe
Size

2.4MB
MD5

af58992019d482d9e9e1b8d460b986a3
SHA1

eebb2ba49fbf3bbbfb44812dded0be2985e993bb
SHA256

72f728eb10da4c23a6f8d7cb2e22fbc5f2dac6090a71c0511a0d5c0f6ba93e2a
SHA512

38b93992d3f51d820413c7aad6b2703e88d33ca23f7a98a7cc1cef2db0bf4a3d7f7ff1e7711e85a9bd038f9c455814f6c1d0581e6ae223eb14e5f5a375dd80fb
SSDEEP

49152:RN2kr6/MLFzU+Cyg/sIxQILycHYdTVkMYTVimZLWcfx4tc0DcqBRg03:z2krm8FzU+as7ILycH8hMFZLBpWc0DK+

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
2460	72f728eb10da4c23a6f8d7cb2e22fbc5f2dac6090a71c0511a0d5c0f6ba93e2a.exe
2460	72f728eb10da4c23a6f8d7cb2e22fbc5f2dac6090a71c0511a0d5c0f6ba93e2a.exe
2460	72f728eb10da4c23a6f8d7cb2e22fbc5f2dac6090a71c0511a0d5c0f6ba93e2a.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3132	2460	WerFault.exe	94
1752	2460	WerFault.exe	94
524	2460	WerFault.exe	94

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2460	72f728eb10da4c23a6f8d7cb2e22fbc5f2dac6090a71c0511a0d5c0f6ba93e2a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 3132	2460	72f728eb10da4c23a6f8d7cb2e22fbc5f2dac6090a71c0511a0d5c0f6ba93e2a.exe	101
PID 2460 wrote to memory of 3132	2460	72f728eb10da4c23a6f8d7cb2e22fbc5f2dac6090a71c0511a0d5c0f6ba93e2a.exe	101
PID 2460 wrote to memory of 3132	2460	72f728eb10da4c23a6f8d7cb2e22fbc5f2dac6090a71c0511a0d5c0f6ba93e2a.exe	101

C:\Users\Admin\AppData\Local\Temp\72f728eb10da4c23a6f8d7cb2e22fbc5f2dac6090a71c0511a0d5c0f6ba93e2a.exe
"C:\Users\Admin\AppData\Local\Temp\72f728eb10da4c23a6f8d7cb2e22fbc5f2dac6090a71c0511a0d5c0f6ba93e2a.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 688
  2⤵
  - Program crash
  PID:3132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 688
  2⤵
  - Program crash
  PID:1752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 688
  2⤵
  - Program crash
  PID:524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2460 -ip 2460
1⤵
PID:2924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4044 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:4116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2460 -ip 2460
1⤵
PID:3900

memory/2460-0-0x0000000000400000-0x0000000000DB4000-memory.dmp

Filesize
9.7MB

Download
memory/2460-1-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download
memory/2460-2-0x0000000000400000-0x0000000000DB4000-memory.dmp

Filesize
9.7MB

Download
memory/2460-3-0x0000000000400000-0x0000000000DB4000-memory.dmp

Filesize
9.7MB

Download
memory/2460-4-0x0000000000400000-0x0000000000DB4000-memory.dmp

Filesize
9.7MB

Download
memory/2460-5-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download
memory/2460-11-0x0000000000400000-0x0000000000DB4000-memory.dmp

Filesize
9.7MB

Download