e0c7a974ee35a0e9410cee3e9bf9e0f6d265e14064449db9e288da4d92e7b447

Analysis

max time kernel
131s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 09:39

Target

e0c7a974ee35a0e9410cee3e9bf9e0f6d265e14064449db9e288da4d92e7b447.exe
Size

713KB
MD5

edcce91324050def7e045bb06be5e0e2
SHA1

0568091db913a7d94aa0f79390971c62ee860714
SHA256

e0c7a974ee35a0e9410cee3e9bf9e0f6d265e14064449db9e288da4d92e7b447
SHA512

6c8a6204991e758bfb9de695408e3605658d7c9f57dff90188a48f005c2c617432555194a5b2e54baa6f554fc210b688d4f04ae4f98fb894168b0b9188c37cde
SSDEEP

12288:9bBPJwKcI0rhsSlsK2SBcLhP+dJUGMYuo2m1qp1H1FWYj2B/VUi4mAmv10i:ZBhcbradKZChINCoXuFWYjg9x10

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1788 set thread context of 2932	1788	e0c7a974ee35a0e9410cee3e9bf9e0f6d265e14064449db9e288da4d92e7b447.exe	104

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4600	2932	WerFault.exe	104

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2932	e0c7a974ee35a0e9410cee3e9bf9e0f6d265e14064449db9e288da4d92e7b447.exe
2932	e0c7a974ee35a0e9410cee3e9bf9e0f6d265e14064449db9e288da4d92e7b447.exe
2932	e0c7a974ee35a0e9410cee3e9bf9e0f6d265e14064449db9e288da4d92e7b447.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 2932	1788	e0c7a974ee35a0e9410cee3e9bf9e0f6d265e14064449db9e288da4d92e7b447.exe	104
PID 1788 wrote to memory of 2932	1788	e0c7a974ee35a0e9410cee3e9bf9e0f6d265e14064449db9e288da4d92e7b447.exe	104
PID 1788 wrote to memory of 2932	1788	e0c7a974ee35a0e9410cee3e9bf9e0f6d265e14064449db9e288da4d92e7b447.exe	104
PID 1788 wrote to memory of 2932	1788	e0c7a974ee35a0e9410cee3e9bf9e0f6d265e14064449db9e288da4d92e7b447.exe	104
PID 1788 wrote to memory of 2932	1788	e0c7a974ee35a0e9410cee3e9bf9e0f6d265e14064449db9e288da4d92e7b447.exe	104
PID 1788 wrote to memory of 2932	1788	e0c7a974ee35a0e9410cee3e9bf9e0f6d265e14064449db9e288da4d92e7b447.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4404,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:8
1⤵
PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2932 -ip 2932
1⤵
PID:2564

memory/1788-6-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download
memory/1788-7-0x0000000005E50000-0x0000000005E68000-memory.dmp

Filesize
96KB

Download
memory/1788-2-0x0000000005E80000-0x0000000006424000-memory.dmp

Filesize
5.6MB

Download
memory/1788-3-0x00000000058D0000-0x0000000005962000-memory.dmp

Filesize
584KB

Download
memory/1788-4-0x0000000005A80000-0x0000000005A8A000-memory.dmp

Filesize
40KB

Download
memory/1788-5-0x0000000005B80000-0x0000000005C1C000-memory.dmp

Filesize
624KB

Download
memory/1788-1-0x0000000000E30000-0x0000000000EE8000-memory.dmp

Filesize
736KB

Download
memory/1788-13-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download
memory/1788-0-0x0000000074B7E000-0x0000000074B7F000-memory.dmp

Filesize
4KB

Download
memory/1788-9-0x00000000083F0000-0x000000000847A000-memory.dmp

Filesize
552KB

Download
memory/1788-8-0x0000000005B70000-0x0000000005B80000-memory.dmp

Filesize
64KB

Download
memory/2932-12-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2932-10-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2932-14-0x0000000001120000-0x000000000146A000-memory.dmp

Filesize
3.3MB

Download
memory/2932-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download