f460aba4130701652e226e6059f5501065b6e6673ffb72aea0a1918af1c6a922

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12-09-2022 08:03

Target

file.exe
Size

271KB
MD5

aee6c62d6b368930e67f0cab675f82db
SHA1

1c17f6a80effc740363e8fdb8812ffa10c9ef0f4
SHA256

f460aba4130701652e226e6059f5501065b6e6673ffb72aea0a1918af1c6a922
SHA512

983e4bc53dc66cfc532bb1c983617f3d94b279871028da6610dc6b315892b30fd5c5231dff1c7d09f9500786cac49c46a4832d4faa4df32e6ed37794f6093f6c
SSDEEP

3072:XJfnJtoWhBBjzo/BcIWfDQ5V8undnwwqVazrQl7Sv7T2FGVnxylCK1:Z0cBjzQB3WfDQ5Vvdfkl7Gv6GVxyss

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 2020 set thread context of 604 2020 file.exe file.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1572 604 WerFault.exe file.exe

description	pid	process	target process
PID 2020 set thread context of 604	2020	file.exe	file.exe

pid	pid_target	process	target process
1572	604	WerFault.exe	file.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

file.exefile.exe

description	pid	process	target process
PID 2020 wrote to memory of 604	2020	file.exe	file.exe
PID 2020 wrote to memory of 604	2020	file.exe	file.exe
PID 2020 wrote to memory of 604	2020	file.exe	file.exe
PID 2020 wrote to memory of 604	2020	file.exe	file.exe
PID 2020 wrote to memory of 604	2020	file.exe	file.exe
PID 2020 wrote to memory of 604	2020	file.exe	file.exe
PID 2020 wrote to memory of 604	2020	file.exe	file.exe
PID 2020 wrote to memory of 604	2020	file.exe	file.exe
PID 2020 wrote to memory of 604	2020	file.exe	file.exe
PID 2020 wrote to memory of 604	2020	file.exe	file.exe
PID 604 wrote to memory of 1572	604	file.exe	WerFault.exe
PID 604 wrote to memory of 1572	604	file.exe	WerFault.exe
PID 604 wrote to memory of 1572	604	file.exe	WerFault.exe
PID 604 wrote to memory of 1572	604	file.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 604 -s 96
3⤵
- Program crash
PID:1572

memory/604-55-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/604-56-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/604-58-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/604-60-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/604-62-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/604-65-0x00000000000941EA-mapping.dmp

Download
memory/604-64-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/604-69-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/604-72-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/1572-73-0x0000000000000000-mapping.dmp

Download
memory/2020-54-0x00000000011F0000-0x0000000001237000-memory.dmp

Filesize
284KB

Download