2b221dbf14e13a190008cb1cdc37923bfd8d9f63e959de2f1676b29d2943edc1

Analysis

max time kernel
29s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 02:48

Target

2b221dbf14e13a190008cb1cdc37923bfd8d9f63e959de2f1676b29d2943edc1.exe
Size

16KB
MD5

28e61f4f5dec79044a15f207d85e97c0
SHA1

00945c6f55e7783ad645b6cad11239b273c00a9b
SHA256

2b221dbf14e13a190008cb1cdc37923bfd8d9f63e959de2f1676b29d2943edc1
SHA512

ae4be5c2b797610f470221c609d5a7faae15bcdbd7538727e87d11ee14c00bcb8c0390224f95b372242c4f19ff82297f4b0302caae8ab81bd7582e56885df40d
SSDEEP

384:XlNOrw9F1XbG5pKi5X5fS7gOaxyrnVo9nxjUL:rbyHKijS8O2yrVo9nRM

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1912 set thread context of 1356	1912	2b221dbf14e13a190008cb1cdc37923bfd8d9f63e959de2f1676b29d2943edc1.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1676	1356	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1912	2b221dbf14e13a190008cb1cdc37923bfd8d9f63e959de2f1676b29d2943edc1.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 1356	1912	2b221dbf14e13a190008cb1cdc37923bfd8d9f63e959de2f1676b29d2943edc1.exe	28
PID 1912 wrote to memory of 1356	1912	2b221dbf14e13a190008cb1cdc37923bfd8d9f63e959de2f1676b29d2943edc1.exe	28
PID 1912 wrote to memory of 1356	1912	2b221dbf14e13a190008cb1cdc37923bfd8d9f63e959de2f1676b29d2943edc1.exe	28
PID 1912 wrote to memory of 1356	1912	2b221dbf14e13a190008cb1cdc37923bfd8d9f63e959de2f1676b29d2943edc1.exe	28
PID 1912 wrote to memory of 1356	1912	2b221dbf14e13a190008cb1cdc37923bfd8d9f63e959de2f1676b29d2943edc1.exe	28
PID 1912 wrote to memory of 1356	1912	2b221dbf14e13a190008cb1cdc37923bfd8d9f63e959de2f1676b29d2943edc1.exe	28
PID 1356 wrote to memory of 1676	1356	2b221dbf14e13a190008cb1cdc37923bfd8d9f63e959de2f1676b29d2943edc1.exe	29
PID 1356 wrote to memory of 1676	1356	2b221dbf14e13a190008cb1cdc37923bfd8d9f63e959de2f1676b29d2943edc1.exe	29
PID 1356 wrote to memory of 1676	1356	2b221dbf14e13a190008cb1cdc37923bfd8d9f63e959de2f1676b29d2943edc1.exe	29
PID 1356 wrote to memory of 1676	1356	2b221dbf14e13a190008cb1cdc37923bfd8d9f63e959de2f1676b29d2943edc1.exe	29

memory/1356-55-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1356-54-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1356-57-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1356-60-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1356-62-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download