c98f4135f4c4eaf6e0ee4c0cbfce4682b1f45026df74c0d015b62b69da9674b1

Analysis

max time kernel
155s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 12:41

Target

BQkrRFZe.exe
Size

58KB
MD5

1c759ea6f86b05ee9837c66fc35d8fbd
SHA1

0384bdc41ecdd84ad480ed0f93c17e5f01d54563
SHA256

c98f4135f4c4eaf6e0ee4c0cbfce4682b1f45026df74c0d015b62b69da9674b1
SHA512

a6a5406ed410a29d183c3a60af92148c35aecb0f4edd89a39198b979d71af4794146f96950cf3929c1ebd03af1e18dab847dd35aa2368d2d21f790e29334e303
SSDEEP

768:NiHaGmJqj/DkKqn5FKwQE8IWlReWfDWf9zTjaCuGiyqFdQ:NWfqqj/DMFv8I8ReUWflaCoFdQ

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 660 set thread context of 3916	660	BQkrRFZe.exe	97

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3076	660	WerFault.exe	92
3240	3916	WerFault.exe	97

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 660 wrote to memory of 3916	660	BQkrRFZe.exe	97
PID 660 wrote to memory of 3916	660	BQkrRFZe.exe	97
PID 660 wrote to memory of 3916	660	BQkrRFZe.exe	97
PID 660 wrote to memory of 3916	660	BQkrRFZe.exe	97

C:\Users\Admin\AppData\Local\Temp\BQkrRFZe.exe
"C:\Users\Admin\AppData\Local\Temp\BQkrRFZe.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:660
- C:\Users\Admin\AppData\Local\Temp\BQkrRFZe.exe
  "C:\Users\Admin\AppData\Local\Temp\BQkrRFZe.exe"
  2⤵
  PID:3916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 284
    3⤵
    - Program crash
    PID:3240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 660 -s 256
  2⤵
  - Program crash
  PID:3076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 660 -ip 660
1⤵
PID:1688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3916 -ip 3916
1⤵
PID:216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:4036