29a1b2044662e0dd7f3059854ed7d49d2511eca878ecf4aad8664292e62dd2d5

Analysis

max time kernel
30s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2024 22:15

Target

Small Malwares/1000004001/gold.exe
Size

1.2MB
MD5

0b7e08a8268a6d413a322ff62d389bf9
SHA1

e04b849cc01779fe256744ad31562aca833a82c1
SHA256

d23a10b3ff0c565ea8ee7f54bcded0582e1e621ebad69d4523d6746f6d8e0e65
SHA512

3d226673e30bbbc27e0a5a6c64bf81eca475c697486b20141df7975bef97901d4865b88f41937f5e3dd00b437f24f91493f80cb69aa366b7a49cd17b26197ba4
SSDEEP

24576:i3KN/uUnwZcPggVmmNp7c/8B2LF8jfjiKriA4BthZ:i3KDwZqggVmmH7F258jfjiKr/4BB

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

gold.exe

description pid process target process

PID 4048 set thread context of 716 4048 gold.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

216 4048 WerFault.exe gold.exe

description	pid	process	target process
PID 4048 set thread context of 716	4048	gold.exe	RegAsm.exe

pid	pid_target	process	target process
216	4048	WerFault.exe	gold.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

gold.exe

description	pid	process	target process
PID 4048 wrote to memory of 716	4048	gold.exe	RegAsm.exe
PID 4048 wrote to memory of 716	4048	gold.exe	RegAsm.exe
PID 4048 wrote to memory of 716	4048	gold.exe	RegAsm.exe
PID 4048 wrote to memory of 716	4048	gold.exe	RegAsm.exe
PID 4048 wrote to memory of 716	4048	gold.exe	RegAsm.exe
PID 4048 wrote to memory of 716	4048	gold.exe	RegAsm.exe
PID 4048 wrote to memory of 716	4048	gold.exe	RegAsm.exe
PID 4048 wrote to memory of 716	4048	gold.exe	RegAsm.exe
PID 4048 wrote to memory of 716	4048	gold.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\Small Malwares\1000004001\gold.exe
"C:\Users\Admin\AppData\Local\Temp\Small Malwares\1000004001\gold.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 272
  2⤵
  - Program crash
  PID:216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4048 -ip 4048
1⤵
PID:2776

memory/716-2-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/716-5-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/716-6-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/716-7-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4048-1-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download
memory/4048-0-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download