f82f959fe8660a9975cbd0255ba069507af5bdb24dc88b47b275ff98fbae0afb

Analysis

max time kernel
103s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 10:13

Target

f82f959fe8660a9975cbd0255ba069507af5bdb24dc88b47b275ff98fbae0afb.exe
Size

743KB
MD5

f53a5b00eaa86439c9bf502a7550f48a
SHA1

e4f80447b09e17553bcbd8925662c9d1d3560ec7
SHA256

f82f959fe8660a9975cbd0255ba069507af5bdb24dc88b47b275ff98fbae0afb
SHA512

801bd0b24a9beba576510c0fec2611280845dfe08c7b2e6af4db1a9fff15d49b71e6db0d80ceaae2bea4884b41372f8f0ef15834c7883abcc9cb44a6f9dbf960
SSDEEP

12288:OyniETpbHidP4i6ilyczuHQYIHbyVyi3z7xdbWOfOEmi89Dj3TBurYcutGAkR:n7bHJQlw5VV37idXlDBY4Mn

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3804 set thread context of 4432	3804	f82f959fe8660a9975cbd0255ba069507af5bdb24dc88b47b275ff98fbae0afb.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1168	4432	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4432	f82f959fe8660a9975cbd0255ba069507af5bdb24dc88b47b275ff98fbae0afb.exe
4432	f82f959fe8660a9975cbd0255ba069507af5bdb24dc88b47b275ff98fbae0afb.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 4432	3804	f82f959fe8660a9975cbd0255ba069507af5bdb24dc88b47b275ff98fbae0afb.exe	83
PID 3804 wrote to memory of 4432	3804	f82f959fe8660a9975cbd0255ba069507af5bdb24dc88b47b275ff98fbae0afb.exe	83
PID 3804 wrote to memory of 4432	3804	f82f959fe8660a9975cbd0255ba069507af5bdb24dc88b47b275ff98fbae0afb.exe	83
PID 3804 wrote to memory of 4432	3804	f82f959fe8660a9975cbd0255ba069507af5bdb24dc88b47b275ff98fbae0afb.exe	83
PID 3804 wrote to memory of 4432	3804	f82f959fe8660a9975cbd0255ba069507af5bdb24dc88b47b275ff98fbae0afb.exe	83
PID 3804 wrote to memory of 4432	3804	f82f959fe8660a9975cbd0255ba069507af5bdb24dc88b47b275ff98fbae0afb.exe	83

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4432 -ip 4432
1⤵
PID:5072

memory/3804-6-0x0000000006960000-0x000000000697E000-memory.dmp

Filesize
120KB

Download
memory/3804-10-0x00000000090B0000-0x000000000914C000-memory.dmp

Filesize
624KB

Download
memory/3804-2-0x0000000005640000-0x0000000005BE4000-memory.dmp

Filesize
5.6MB

Download
memory/3804-3-0x0000000005090000-0x0000000005122000-memory.dmp

Filesize
584KB

Download
memory/3804-4-0x00000000051A0000-0x00000000051AA000-memory.dmp

Filesize
40KB

Download
memory/3804-5-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/3804-1-0x00000000006B0000-0x000000000076A000-memory.dmp

Filesize
744KB

Download
memory/3804-8-0x0000000006350000-0x0000000006366000-memory.dmp

Filesize
88KB

Download
memory/3804-0-0x000000007484E000-0x000000007484F000-memory.dmp

Filesize
4KB

Download
memory/3804-9-0x0000000006A10000-0x0000000006A9A000-memory.dmp

Filesize
552KB

Download
memory/3804-7-0x0000000006310000-0x0000000006320000-memory.dmp

Filesize
64KB

Download
memory/3804-13-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/4432-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4432-14-0x0000000001120000-0x000000000146A000-memory.dmp

Filesize
3.3MB

Download
memory/4432-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download