7179fcb3469bbfb096f43703ef4dc1cf29971cc325bb66f9ce26e9eaa2a83d00

Analysis

max time kernel
128s
max time network
142s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18/08/2022, 03:01

Target
bf84f9098a2faf3d60bddcfe405ea5de.exe
Size 239KB
Sample220818-dhwd9sgdaq
SHA256 7179fcb3469bbfb096f43703ef4dc1cf29971cc325bb66f9ce26e9eaa2a83d00
MD5 bf84f9098a2faf3d60bddcfe405ea5de
SHA1 e056b5c49f2dbe40290d314d7ccd7f0f3e109b71
SHA512 c49063d9b201a55cd68f2f601eed159ed7a2f5d9ccd6cc66f7ce407bc1b59fd0e201effde9f30efaecfde4ed84a1d94268019d4d42614e94139b1d42411f01b7
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1096 set thread context of 1808	1096	bf84f9098a2faf3d60bddcfe405ea5de.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1684	1096	WerFault.exe	27

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1808	1096	bf84f9098a2faf3d60bddcfe405ea5de.exe	28
PID 1096 wrote to memory of 1808	1096	bf84f9098a2faf3d60bddcfe405ea5de.exe	28
PID 1096 wrote to memory of 1808	1096	bf84f9098a2faf3d60bddcfe405ea5de.exe	28
PID 1096 wrote to memory of 1808	1096	bf84f9098a2faf3d60bddcfe405ea5de.exe	28
PID 1096 wrote to memory of 1808	1096	bf84f9098a2faf3d60bddcfe405ea5de.exe	28
PID 1096 wrote to memory of 1808	1096	bf84f9098a2faf3d60bddcfe405ea5de.exe	28
PID 1096 wrote to memory of 1808	1096	bf84f9098a2faf3d60bddcfe405ea5de.exe	28
PID 1096 wrote to memory of 1808	1096	bf84f9098a2faf3d60bddcfe405ea5de.exe	28
PID 1096 wrote to memory of 1808	1096	bf84f9098a2faf3d60bddcfe405ea5de.exe	28
PID 1096 wrote to memory of 1684	1096	bf84f9098a2faf3d60bddcfe405ea5de.exe	29
PID 1096 wrote to memory of 1684	1096	bf84f9098a2faf3d60bddcfe405ea5de.exe	29
PID 1096 wrote to memory of 1684	1096	bf84f9098a2faf3d60bddcfe405ea5de.exe	29
PID 1096 wrote to memory of 1684	1096	bf84f9098a2faf3d60bddcfe405ea5de.exe	29

C:\Users\Admin\AppData\Local\Temp\bf84f9098a2faf3d60bddcfe405ea5de.exe
"C:\Users\Admin\AppData\Local\Temp\bf84f9098a2faf3d60bddcfe405ea5de.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:1808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 88
  2⤵
  - Program crash
  PID:1684

memory/1096-54-0x0000000000E20000-0x0000000000E5D000-memory.dmp

Download

memory/1096-68-0x0000000000E20000-0x0000000000E5D000-memory.dmp

Download

memory/1808-57-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1808-55-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1808-65-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1808-66-0x0000000075211000-0x0000000075213000-memory.dmp

Download