7f72bb2eb4ea1f0914a9cb1de72d424efe2e183a7a78ef974a655914a9ce9790

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
09-09-2022 04:47

Target

7f72bb2eb4ea1f0914a9cb1de72d424efe2e183a7a78ef974a655914a9ce9790.exe
Size

6.5MB
MD5

a037f22807116f6b8353480b4898f642
SHA1

81c121d4b201faadc62ea29e1caa0e855abc6dc1
SHA256

7f72bb2eb4ea1f0914a9cb1de72d424efe2e183a7a78ef974a655914a9ce9790
SHA512

1b2e811b521fe0808da99ef556aed386d47c1556b6d7656c630e3080585465da16f445a3a28058986483da785544d849cdc7b6a39fe834143155a20ae7b436bb
SSDEEP

196608:O3oKkJpbmOREqZa30Kq++67O1bVrPphR5:Wo3QOREJqjvBPvH

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2016	7f72bb2eb4ea1f0914a9cb1de72d424efe2e183a7a78ef974a655914a9ce9790.exe
2016	7f72bb2eb4ea1f0914a9cb1de72d424efe2e183a7a78ef974a655914a9ce9790.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2044	2016	WerFault.exe	25

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2016	7f72bb2eb4ea1f0914a9cb1de72d424efe2e183a7a78ef974a655914a9ce9790.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2044	2016	7f72bb2eb4ea1f0914a9cb1de72d424efe2e183a7a78ef974a655914a9ce9790.exe	26
PID 2016 wrote to memory of 2044	2016	7f72bb2eb4ea1f0914a9cb1de72d424efe2e183a7a78ef974a655914a9ce9790.exe	26
PID 2016 wrote to memory of 2044	2016	7f72bb2eb4ea1f0914a9cb1de72d424efe2e183a7a78ef974a655914a9ce9790.exe	26
PID 2016 wrote to memory of 2044	2016	7f72bb2eb4ea1f0914a9cb1de72d424efe2e183a7a78ef974a655914a9ce9790.exe	26

C:\Users\Admin\AppData\Local\Temp\7f72bb2eb4ea1f0914a9cb1de72d424efe2e183a7a78ef974a655914a9ce9790.exe
"C:\Users\Admin\AppData\Local\Temp\7f72bb2eb4ea1f0914a9cb1de72d424efe2e183a7a78ef974a655914a9ce9790.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 92
  2⤵
  - Program crash
  PID:2044

memory/2016-54-0x0000000000400000-0x0000000001278000-memory.dmp

Filesize
14.5MB

Download
memory/2016-56-0x0000000000400000-0x0000000001278000-memory.dmp

Filesize
14.5MB

Download
memory/2016-58-0x000000000139B000-0x00000000013C1000-memory.dmp

Filesize
152KB

Download
memory/2016-59-0x0000000000330000-0x0000000000360000-memory.dmp

Filesize
192KB

Download
memory/2016-60-0x0000000000400000-0x0000000001278000-memory.dmp

Filesize
14.5MB

Download