d0c0cf8443e8c42fe50dbd8c23fa0812155c24107d012812f6be5facf5f0b71f

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
27-06-2024 19:39

Target

github.software.1.1.8/github.software.1.1.8.exe
Size

526KB
MD5

87f9b840bb41a3488601bbb3e4e1fbd7
SHA1

843df85b4df246a97bb93124f2d3bc8a35845792
SHA256

5fbd74b727784725db522b21fb0b291ceaa9f99082f238c8b27977e2ab34d785
SHA512

185180b8dfad633114e21c8ae00d164175634b797f9e4e9ff7a961fce4cf2cfee1edd335a97105aa49f40618eb403b5721ae264552d40245de8aa9a4010adb0a
SSDEEP

12288:dV8l+nZJDPijrLnL999fn6nVwt9suceSUvnpuY9:dmoZJji3LnL999fn6nVwvsuceSsp

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

github.software.1.1.8.exe

description pid process target process

PID 1144 set thread context of 2060 1144 github.software.1.1.8.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4916 1144 WerFault.exe github.software.1.1.8.exe

description	pid	process	target process
PID 1144 set thread context of 2060	1144	github.software.1.1.8.exe	RegAsm.exe

pid	pid_target	process	target process
4916	1144	WerFault.exe	github.software.1.1.8.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

github.software.1.1.8.exe

description	pid	process	target process
PID 1144 wrote to memory of 2060	1144	github.software.1.1.8.exe	RegAsm.exe
PID 1144 wrote to memory of 2060	1144	github.software.1.1.8.exe	RegAsm.exe
PID 1144 wrote to memory of 2060	1144	github.software.1.1.8.exe	RegAsm.exe
PID 1144 wrote to memory of 2060	1144	github.software.1.1.8.exe	RegAsm.exe
PID 1144 wrote to memory of 2060	1144	github.software.1.1.8.exe	RegAsm.exe
PID 1144 wrote to memory of 2060	1144	github.software.1.1.8.exe	RegAsm.exe
PID 1144 wrote to memory of 2060	1144	github.software.1.1.8.exe	RegAsm.exe
PID 1144 wrote to memory of 2060	1144	github.software.1.1.8.exe	RegAsm.exe
PID 1144 wrote to memory of 2060	1144	github.software.1.1.8.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:2060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 296
2⤵
- Program crash
PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1144 -ip 1144
1⤵
PID:4956

memory/1144-1-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/2060-0-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2060-3-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2060-4-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download