af60abc8f32a47fe154e7f5a9e6910200f944524f437f45686f53ad4c49b0098

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-09-2022 11:36

Target

file.exe
Size

597KB
MD5

dc31dd18ff73547678378541a5d8f6e8
SHA1

8b918dfce983cf699ace47d3daec43cef8c800a1
SHA256

af60abc8f32a47fe154e7f5a9e6910200f944524f437f45686f53ad4c49b0098
SHA512

f8d3af1f39ab7de9acf8f830d34d847c0761ac16c4a6c3349112887bfd51aac4f996a7217ed7210e79447a4444af05dc4700b5a54e58e7ec68dd963d94723ba4
SSDEEP

6144:9yBjzrLQCokvmTcVDBIdmDazpvuFKvXd/ccjuJSfP:ifuoVDBIdmmV+iXRaJCP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 1132 set thread context of 1296 1132 file.exe file.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1536 1296 WerFault.exe file.exe

description	pid	process	target process
PID 1132 set thread context of 1296	1132	file.exe	file.exe

pid	pid_target	process	target process
1536	1296	WerFault.exe	file.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

file.exefile.exe

description	pid	process	target process
PID 1132 wrote to memory of 1296	1132	file.exe	file.exe
PID 1132 wrote to memory of 1296	1132	file.exe	file.exe
PID 1132 wrote to memory of 1296	1132	file.exe	file.exe
PID 1132 wrote to memory of 1296	1132	file.exe	file.exe
PID 1132 wrote to memory of 1296	1132	file.exe	file.exe
PID 1132 wrote to memory of 1296	1132	file.exe	file.exe
PID 1132 wrote to memory of 1296	1132	file.exe	file.exe
PID 1132 wrote to memory of 1296	1132	file.exe	file.exe
PID 1132 wrote to memory of 1296	1132	file.exe	file.exe
PID 1132 wrote to memory of 1296	1132	file.exe	file.exe
PID 1296 wrote to memory of 1536	1296	file.exe	WerFault.exe
PID 1296 wrote to memory of 1536	1296	file.exe	WerFault.exe
PID 1296 wrote to memory of 1536	1296	file.exe	WerFault.exe
PID 1296 wrote to memory of 1536	1296	file.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 96
3⤵
- Program crash
PID:1536

memory/1132-54-0x00000000002D0000-0x000000000036A000-memory.dmp

Filesize
616KB

Download
memory/1296-55-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/1296-56-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/1296-58-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/1296-60-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/1296-62-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/1296-64-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/1296-65-0x000000000009436C-mapping.dmp

Download
memory/1296-69-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/1296-72-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/1536-73-0x0000000000000000-mapping.dmp

Download