c992ef827d88ae7a24a9ae36ab7406ad9366f4783d258c8ac3957a2ab54c3d83

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
22-09-2022 13:51

Target

file.exe
Size

7.5MB
MD5

a1936300c71efd096e2caca62af4c4a9
SHA1

cb2d0f1e56f7b8016ec5b61dd8e80a238b408715
SHA256

c992ef827d88ae7a24a9ae36ab7406ad9366f4783d258c8ac3957a2ab54c3d83
SHA512

a5a576e96511ae12e0bfb84d088f9dceabf2b53e570c723ac10079ceeb4f1ea3c31dd6cc6239b4b6b8836d0f8bc772b8adc6ac8b71d3b7c39a01af177d1784be
SSDEEP

196608:hRToN416hR2fFkD4fE+++9iTsCsa1nGzxDQUfyIb6H//OeVPlXMwN:583

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 1504 set thread context of 2040 1504 file.exe file.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1304 2040 WerFault.exe file.exe

description	pid	process	target process
PID 1504 set thread context of 2040	1504	file.exe	file.exe

pid	pid_target	process	target process
1304	2040	WerFault.exe	file.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

file.exefile.exe

description	pid	process	target process
PID 1504 wrote to memory of 2040	1504	file.exe	file.exe
PID 1504 wrote to memory of 2040	1504	file.exe	file.exe
PID 1504 wrote to memory of 2040	1504	file.exe	file.exe
PID 1504 wrote to memory of 2040	1504	file.exe	file.exe
PID 1504 wrote to memory of 2040	1504	file.exe	file.exe
PID 1504 wrote to memory of 2040	1504	file.exe	file.exe
PID 1504 wrote to memory of 2040	1504	file.exe	file.exe
PID 1504 wrote to memory of 2040	1504	file.exe	file.exe
PID 1504 wrote to memory of 2040	1504	file.exe	file.exe
PID 1504 wrote to memory of 2040	1504	file.exe	file.exe
PID 2040 wrote to memory of 1304	2040	file.exe	WerFault.exe
PID 2040 wrote to memory of 1304	2040	file.exe	WerFault.exe
PID 2040 wrote to memory of 1304	2040	file.exe	WerFault.exe
PID 2040 wrote to memory of 1304	2040	file.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 96
3⤵
- Program crash
PID:1304

memory/1304-73-0x0000000000000000-mapping.dmp

Download
memory/1504-54-0x00000000008A0000-0x000000000101B000-memory.dmp

Filesize
7.5MB

Download
memory/2040-55-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/2040-56-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/2040-58-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/2040-60-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/2040-62-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/2040-69-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/2040-65-0x000000000009436C-mapping.dmp

Download
memory/2040-64-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/2040-72-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download