c6f5607edc349b4c6f42ef6f0c5bbd77b56ad538a747a8d7a508f11d2277948b

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 12:06

Target

VapeClient.exe
Size

8.1MB
MD5

02791ad2d947ebdb938f93d2d5ed030d
SHA1

42ac01af1dc957d9dc94f241507812f9fe3a01b8
SHA256

c6f5607edc349b4c6f42ef6f0c5bbd77b56ad538a747a8d7a508f11d2277948b
SHA512

3fb20d156052cf13cd946345eeb914d548c0db9f136065a9a13df618e60a29436ea8faa8a1f8041b1ed0beae237eb92cc1826bb850ba61d3c8d602af8e8532ac
SSDEEP

49152:AHYNTlMLejxW3XZxG7jD0fYHpjls2su6DIvZ83m+ZUh2iB6XQkddqonuMVf68HF+:AwCyjx4XZ1fcTyrIxOS

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1964 set thread context of 4424	1964	VapeClient.exe	85

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5096	4424	WerFault.exe	85

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	VapeClient.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 4424	1964	VapeClient.exe	85
PID 1964 wrote to memory of 4424	1964	VapeClient.exe	85
PID 1964 wrote to memory of 4424	1964	VapeClient.exe	85
PID 1964 wrote to memory of 4424	1964	VapeClient.exe	85
PID 1964 wrote to memory of 4424	1964	VapeClient.exe	85
PID 1964 wrote to memory of 4424	1964	VapeClient.exe	85
PID 1964 wrote to memory of 4424	1964	VapeClient.exe	85
PID 1964 wrote to memory of 4424	1964	VapeClient.exe	85
PID 1964 wrote to memory of 4424	1964	VapeClient.exe	85
PID 1964 wrote to memory of 4424	1964	VapeClient.exe	85
PID 1964 wrote to memory of 4424	1964	VapeClient.exe	85

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4424 -ip 4424
1⤵
PID:4176

memory/1964-0-0x000000007501E000-0x000000007501F000-memory.dmp

Filesize
4KB

Download
memory/1964-1-0x0000000000810000-0x0000000001036000-memory.dmp

Filesize
8.1MB

Download
memory/1964-2-0x0000000075010000-0x00000000757C0000-memory.dmp

Filesize
7.7MB

Download
memory/1964-3-0x0000000006370000-0x0000000006380000-memory.dmp

Filesize
64KB

Download
memory/1964-4-0x0000000007680000-0x0000000007688000-memory.dmp

Filesize
32KB

Download
memory/1964-12-0x0000000075010000-0x00000000757C0000-memory.dmp

Filesize
7.7MB

Download
memory/4424-5-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4424-6-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4424-11-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4424-9-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download