716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 01:30

Target

716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe
Size

2.7MB
MD5

d2f812118c89341715fbff0ba9530396
SHA1

8e9cfa2ebe51e9f71d55b161fb13aae13ee3744f
SHA256

716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d
SHA512

7a1884c5b2130db511f318103ece6ae1499c1e877e4dfc39d6c83b762febea258b5921fa72ae3b413ecfc752b571b2ce33f6fa1f680461d94fc3d2f1988d6c77
SSDEEP

24576:tRoBHi3buy4toE1jC6Ayo2xhWLbSPlqRvc68XzRVGvQB5VA0UC1dUUKj/LZ8j3gy:boKmo4jC6Tov2RUC1doj/wgy

Score

9^/10

Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs

resource	yara_rule
behavioral2/memory/2720-1-0x0000000000400000-0x0000000000408000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4176 set thread context of 2720	4176	716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2016	2720	WerFault.exe	86

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 2720	4176	716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe	86
PID 4176 wrote to memory of 2720	4176	716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe	86
PID 4176 wrote to memory of 2720	4176	716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe	86
PID 4176 wrote to memory of 2720	4176	716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe	86
PID 4176 wrote to memory of 2720	4176	716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe	86
PID 4176 wrote to memory of 2720	4176	716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe	86
PID 4176 wrote to memory of 2720	4176	716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe	86
PID 4176 wrote to memory of 2720	4176	716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe	86

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2720 -ip 2720
1⤵
PID:4996

memory/2720-1-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4176-0-0x00007FF7D3E30000-0x00007FF7D4179000-memory.dmp

Filesize
3.3MB

Download
memory/4176-2-0x00007FF7D3E30000-0x00007FF7D4179000-memory.dmp

Filesize
3.3MB

Download