2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3

Analysis

max time kernel
89s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
21-05-2024 04:53

Target

2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe
Size

791KB
MD5

c4a6297b79141d28849a7d5c3a7f046c
SHA1

65fc3f8aff2aade19bc0a9c4fbd6ecaf9f94d071
SHA256

2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3
SHA512

b96822fb3bc8abca6c4d2301a20e730b73ab93306ee22f408a05910eb6904a9db186134986384f7a1a5462f532760d39f6bb20885e5801472726af328e166015
SSDEEP

12288:xIlWET/mr9K+22BEEzFatnv1KakJkeYXrluEyfXfKDhOJodTVWWUjy0CUTrLJXgX:KWtb3BEN1QCrEEESDh9TVWFy0CQy

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 8 set thread context of 4292	8	2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe	81

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1032	4292	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4292	2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe
4292	2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 4292	8	2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe	81
PID 8 wrote to memory of 4292	8	2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe	81
PID 8 wrote to memory of 4292	8	2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe	81
PID 8 wrote to memory of 4292	8	2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe	81
PID 8 wrote to memory of 4292	8	2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe	81
PID 8 wrote to memory of 4292	8	2dad4966cfeff750760dbac52eb1db02b77515fe06599a756bf4bdfb6a7e9df3.exe	81

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4292 -ip 4292
1⤵
PID:3792

memory/8-8-0x0000000003360000-0x0000000003370000-memory.dmp

Filesize
64KB

Download
memory/8-6-0x0000000005DE0000-0x0000000005E02000-memory.dmp

Filesize
136KB

Download
memory/8-2-0x0000000006060000-0x0000000006606000-memory.dmp

Filesize
5.6MB

Download
memory/8-3-0x0000000005B50000-0x0000000005BE2000-memory.dmp

Filesize
584KB

Download
memory/8-0-0x00000000747BE000-0x00000000747BF000-memory.dmp

Filesize
4KB

Download
memory/8-5-0x00000000747B0000-0x0000000074F61000-memory.dmp

Filesize
7.7MB

Download
memory/8-1-0x0000000000F20000-0x0000000000FEC000-memory.dmp

Filesize
816KB

Download
memory/8-7-0x0000000005B00000-0x0000000005B0C000-memory.dmp

Filesize
48KB

Download
memory/8-4-0x0000000005AB0000-0x0000000005ABA000-memory.dmp

Filesize
40KB

Download
memory/8-9-0x000000000DD10000-0x000000000DD9A000-memory.dmp

Filesize
552KB

Download
memory/8-10-0x0000000011500000-0x000000001159C000-memory.dmp

Filesize
624KB

Download
memory/8-14-0x00000000747B0000-0x0000000074F61000-memory.dmp

Filesize
7.7MB

Download
memory/4292-13-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4292-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4292-15-0x00000000017E0000-0x0000000001B36000-memory.dmp

Filesize
3.3MB

Download
memory/4292-16-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download