014614e6650f00448b18b594013d532043165806280ac04e0e1aab9c9d7d8ad3

Analysis

max time kernel
140s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 00:57

Target
Client/nQMailer.exe
Size 480KB
Sample240517-ba7q8aab65
SHA256 5979d135530e3deaacfef9318a85d19a58e3a3a7010830f23ad375379d660c9b
MD5 7267a267fda78ca30e36fa2bcac8ce09
SHA1 49bfcfd356b9bf716c9e77c5581cb29aac69d741
SHA512 d3641ff8ea4737ecf0b8da1b67ed902abc539071f4649971ce3ef33d1eb538fe13051ab69e4c23f8a77fa21fca8cf8ffdf204931d267044a6f85420f2ba039c4
SSDEEP 12288:uFwm7eeXnROkg1oytE6wAnRq70xGI3a+OQSNZzSfy7xYkpdz2TGUDP3ttp6mKY:uMeJQYzjmP3tr6m
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3672 set thread context of 1188	3672	nQMailer.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3660	1188	WerFault.exe	83

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 1188	3672	nQMailer.exe	83
PID 3672 wrote to memory of 1188	3672	nQMailer.exe	83
PID 3672 wrote to memory of 1188	3672	nQMailer.exe	83
PID 3672 wrote to memory of 1188	3672	nQMailer.exe	83
PID 3672 wrote to memory of 1188	3672	nQMailer.exe	83

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1188 -ip 1188
1⤵
PID:3256

memory/1188-1-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/3672-0-0x0000000000640000-0x0000000000641000-memory.dmp

Download

memory/3672-2-0x0000000000400000-0x000000000047E000-memory.dmp

Download