b411fa289b897c774560292abcf7c298e29e1b9b8243357b1cc7d25a28622739

Analysis

max time kernel
147s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
22-04-2024 04:56

Target

launcher.exe
Size

25.4MB
MD5

913b4744fbcd88cbc9ba44808a835a91
SHA1

d5cb6cbe5d4ad8b20a351080a6bc8e85fa72a64e
SHA256

b411fa289b897c774560292abcf7c298e29e1b9b8243357b1cc7d25a28622739
SHA512

ab0c1ec3840947262d4825bbc1cb1f0f056fceda99d7886ce7f83c432faf91a89e17f81e21132a9f997a895c0dd3cdb3d987b47608020cb1260657d782847863
SSDEEP

12288:5R5ouJIVQhcEWuDG6X/ob2qlTIiw/TmQxFZpC:dnJIG2EFlf09GTmYvC

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

launcher.exe

description pid process target process

PID 4388 set thread context of 3724 4388 launcher.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4300 4388 WerFault.exe launcher.exe

description	pid	process	target process
PID 4388 set thread context of 3724	4388	launcher.exe	RegAsm.exe

pid	pid_target	process	target process
4300	4388	WerFault.exe	launcher.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

launcher.exe

description	pid	process	target process
PID 4388 wrote to memory of 3724	4388	launcher.exe	RegAsm.exe
PID 4388 wrote to memory of 3724	4388	launcher.exe	RegAsm.exe
PID 4388 wrote to memory of 3724	4388	launcher.exe	RegAsm.exe
PID 4388 wrote to memory of 3724	4388	launcher.exe	RegAsm.exe
PID 4388 wrote to memory of 3724	4388	launcher.exe	RegAsm.exe
PID 4388 wrote to memory of 3724	4388	launcher.exe	RegAsm.exe
PID 4388 wrote to memory of 3724	4388	launcher.exe	RegAsm.exe
PID 4388 wrote to memory of 3724	4388	launcher.exe	RegAsm.exe
PID 4388 wrote to memory of 3724	4388	launcher.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\launcher.exe
"C:\Users\Admin\AppData\Local\Temp\launcher.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 424
  2⤵
  - Program crash
  PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4388 -ip 4388
1⤵
PID:4060

memory/3724-1-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3724-3-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3724-4-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3724-6-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4388-0-0x0000000000F40000-0x0000000000FB4000-memory.dmp

Filesize
464KB

Download
memory/4388-5-0x0000000000F40000-0x0000000000FB4000-memory.dmp

Filesize
464KB

Download