46bbd8bfd207c958a5a695daefff47cd021898dd248d13c1a0e8b0dbc8466c2a

Analysis

max time kernel
92s
max time network
99s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
14/05/2024, 07:50

Target

46bbd8bfd207c958a5a695daefff47cd021898dd248d13c1a0e8b0dbc8466c2a.exe
Size

722KB
MD5

ac29e1539ac0881736b0bb92e2940ab1
SHA1

2c0f0f06a7936b11d5b99d856c8d3b92d7ff5321
SHA256

46bbd8bfd207c958a5a695daefff47cd021898dd248d13c1a0e8b0dbc8466c2a
SHA512

0894e006882ee980f51d37026c035bd526e6012505f6e4125850d383e7b2d67ffa093917761451eb6471408d7461a0a6240d466f47c38bfc2203e82b67bab1a0
SSDEEP

12288:XIOQcS0vv0U0HNSe/oHRq3PDekJ3+4UmeQxsDSMveudY6Xwnen:YOQcSgv09SGUqbeQO43QSMvtdY6gnen

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4428 set thread context of 4368	4428	46bbd8bfd207c958a5a695daefff47cd021898dd248d13c1a0e8b0dbc8466c2a.exe	80

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1128	4368	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4368	46bbd8bfd207c958a5a695daefff47cd021898dd248d13c1a0e8b0dbc8466c2a.exe
4368	46bbd8bfd207c958a5a695daefff47cd021898dd248d13c1a0e8b0dbc8466c2a.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 4368	4428	46bbd8bfd207c958a5a695daefff47cd021898dd248d13c1a0e8b0dbc8466c2a.exe	80
PID 4428 wrote to memory of 4368	4428	46bbd8bfd207c958a5a695daefff47cd021898dd248d13c1a0e8b0dbc8466c2a.exe	80
PID 4428 wrote to memory of 4368	4428	46bbd8bfd207c958a5a695daefff47cd021898dd248d13c1a0e8b0dbc8466c2a.exe	80
PID 4428 wrote to memory of 4368	4428	46bbd8bfd207c958a5a695daefff47cd021898dd248d13c1a0e8b0dbc8466c2a.exe	80
PID 4428 wrote to memory of 4368	4428	46bbd8bfd207c958a5a695daefff47cd021898dd248d13c1a0e8b0dbc8466c2a.exe	80
PID 4428 wrote to memory of 4368	4428	46bbd8bfd207c958a5a695daefff47cd021898dd248d13c1a0e8b0dbc8466c2a.exe	80

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4368 -ip 4368
1⤵
PID:488

memory/4368-9-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4368-12-0x00000000018D0000-0x0000000001C26000-memory.dmp

Filesize
3.3MB

Download
memory/4368-13-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4428-0-0x0000000074EDE000-0x0000000074EDF000-memory.dmp

Filesize
4KB

Download
memory/4428-1-0x0000000000170000-0x000000000022A000-memory.dmp

Filesize
744KB

Download
memory/4428-2-0x0000000004CD0000-0x0000000004D46000-memory.dmp

Filesize
472KB

Download
memory/4428-3-0x0000000005330000-0x00000000058D6000-memory.dmp

Filesize
5.6MB

Download
memory/4428-4-0x0000000004E60000-0x0000000004EF2000-memory.dmp

Filesize
584KB

Download
memory/4428-5-0x0000000004F00000-0x0000000004F9C000-memory.dmp

Filesize
624KB

Download
memory/4428-6-0x0000000004D50000-0x0000000004D58000-memory.dmp

Filesize
32KB

Download
memory/4428-8-0x0000000074ED0000-0x0000000075681000-memory.dmp

Filesize
7.7MB

Download
memory/4428-11-0x0000000074ED0000-0x0000000075681000-memory.dmp

Filesize
7.7MB

Download