fbf3a7baa5927d504978c2e85715039f2329a12abd5260920f4ad0066c174493

Analysis

max time kernel
131s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2024 10:09

Target

cb225661c987049bf363fa619496b15c.exe
Size

92KB
MD5

cb225661c987049bf363fa619496b15c
SHA1

c83f5383315ee42ca65127cb32f70ed10a1fe9d0
SHA256

fbf3a7baa5927d504978c2e85715039f2329a12abd5260920f4ad0066c174493
SHA512

538bc16ebcb721b071008362f9877a36e80ec580012f14f76700c9d584081d6e8cd48dbf8f68f535c4ad3eab4e02f1bfa1d0a252bd09d430502501e60da25d35
SSDEEP

1536:F8gzQb7cTO4YTnBlXpcn5RvPGZvaQqMOOg8WhwIED9pl4b:GgzKZ5TBlXi+7qM9g882Dzl4b

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

cb225661c987049bf363fa619496b15c.exe

description pid process target process

PID 4464 set thread context of 4416 4464 cb225661c987049bf363fa619496b15c.exe cb225661c987049bf363fa619496b15c.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4588 4416 WerFault.exe cb225661c987049bf363fa619496b15c.exe

description	pid	process	target process
PID 4464 set thread context of 4416	4464	cb225661c987049bf363fa619496b15c.exe	cb225661c987049bf363fa619496b15c.exe

pid	pid_target	process	target process
4588	4416	WerFault.exe	cb225661c987049bf363fa619496b15c.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

cb225661c987049bf363fa619496b15c.exe

description	pid	process	target process
PID 4464 wrote to memory of 4416	4464	cb225661c987049bf363fa619496b15c.exe	cb225661c987049bf363fa619496b15c.exe
PID 4464 wrote to memory of 4416	4464	cb225661c987049bf363fa619496b15c.exe	cb225661c987049bf363fa619496b15c.exe
PID 4464 wrote to memory of 4416	4464	cb225661c987049bf363fa619496b15c.exe	cb225661c987049bf363fa619496b15c.exe
PID 4464 wrote to memory of 4416	4464	cb225661c987049bf363fa619496b15c.exe	cb225661c987049bf363fa619496b15c.exe
PID 4464 wrote to memory of 4416	4464	cb225661c987049bf363fa619496b15c.exe	cb225661c987049bf363fa619496b15c.exe
PID 4464 wrote to memory of 4416	4464	cb225661c987049bf363fa619496b15c.exe	cb225661c987049bf363fa619496b15c.exe
PID 4464 wrote to memory of 4416	4464	cb225661c987049bf363fa619496b15c.exe	cb225661c987049bf363fa619496b15c.exe
PID 4464 wrote to memory of 4416	4464	cb225661c987049bf363fa619496b15c.exe	cb225661c987049bf363fa619496b15c.exe

C:\Users\Admin\AppData\Local\Temp\cb225661c987049bf363fa619496b15c.exe
"C:\Users\Admin\AppData\Local\Temp\cb225661c987049bf363fa619496b15c.exe"
2⤵
PID:4416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 364
3⤵
- Program crash
PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4416 -ip 4416
1⤵
PID:3136

memory/4416-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4416-1-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4416-2-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4416-3-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download