af60abc8f32a47fe154e7f5a9e6910200f944524f437f45686f53ad4c49b0098

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
26-09-2022 11:36

Target

file.exe
Size

597KB
MD5

dc31dd18ff73547678378541a5d8f6e8
SHA1

8b918dfce983cf699ace47d3daec43cef8c800a1
SHA256

af60abc8f32a47fe154e7f5a9e6910200f944524f437f45686f53ad4c49b0098
SHA512

f8d3af1f39ab7de9acf8f830d34d847c0761ac16c4a6c3349112887bfd51aac4f996a7217ed7210e79447a4444af05dc4700b5a54e58e7ec68dd963d94723ba4
SSDEEP

6144:9yBjzrLQCokvmTcVDBIdmDazpvuFKvXd/ccjuJSfP:ifuoVDBIdmmV+iXRaJCP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 1768 set thread context of 1716 1768 file.exe file.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1520 1716 WerFault.exe file.exe

description	pid	process	target process
PID 1768 set thread context of 1716	1768	file.exe	file.exe

pid	pid_target	process	target process
1520	1716	WerFault.exe	file.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

file.exefile.exe

description	pid	process	target process
PID 1768 wrote to memory of 1716	1768	file.exe	file.exe
PID 1768 wrote to memory of 1716	1768	file.exe	file.exe
PID 1768 wrote to memory of 1716	1768	file.exe	file.exe
PID 1768 wrote to memory of 1716	1768	file.exe	file.exe
PID 1768 wrote to memory of 1716	1768	file.exe	file.exe
PID 1768 wrote to memory of 1716	1768	file.exe	file.exe
PID 1768 wrote to memory of 1716	1768	file.exe	file.exe
PID 1768 wrote to memory of 1716	1768	file.exe	file.exe
PID 1768 wrote to memory of 1716	1768	file.exe	file.exe
PID 1768 wrote to memory of 1716	1768	file.exe	file.exe
PID 1716 wrote to memory of 1520	1716	file.exe	WerFault.exe
PID 1716 wrote to memory of 1520	1716	file.exe	WerFault.exe
PID 1716 wrote to memory of 1520	1716	file.exe	WerFault.exe
PID 1716 wrote to memory of 1520	1716	file.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 96
3⤵
- Program crash
PID:1520

memory/1520-73-0x0000000000000000-mapping.dmp

Download
memory/1716-55-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/1716-56-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/1716-58-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/1716-60-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/1716-62-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/1716-64-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/1716-65-0x000000000009436C-mapping.dmp

Download
memory/1716-69-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/1716-72-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/1768-54-0x0000000000260000-0x00000000002FA000-memory.dmp

Filesize
616KB

Download