cf77690d2d383b1439dc78861594c26973b892ef30607a4f66e6e1da653f0614

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 15:35

Target

cf77690d2d383b1439dc78861594c26973b892ef30607a4f66e6e1da653f0614.exe
Size

56KB
MD5

0d5c10140f953e1efe380bd9568bb020
SHA1

fa3f37d482a4406e47a2daa8d1fb7fec14c7f641
SHA256

cf77690d2d383b1439dc78861594c26973b892ef30607a4f66e6e1da653f0614
SHA512

73314870fad9c12b8c958347fce5df810a7fc4fc62b641a62cb8b4282c2383bea76c8d7d551dd08986c6cae111b8dbde4e1a433bdbdf52766cc2e2b3b15c7480
SSDEEP

768:dSY6BLYWhFcrFKB1xxVh25AjYQ+u6xqs4MmPA93DoybfcPj1CI8:dlucoBFVPjYe2qs4v49JUP5C

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1200 set thread context of 1056	1200	cf77690d2d383b1439dc78861594c26973b892ef30607a4f66e6e1da653f0614.exe	27

Program crash 1 IoCs

pid	pid_target	Process	procid_target
668	1200	WerFault.exe	26

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1200	cf77690d2d383b1439dc78861594c26973b892ef30607a4f66e6e1da653f0614.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 1056	1200	cf77690d2d383b1439dc78861594c26973b892ef30607a4f66e6e1da653f0614.exe	27
PID 1200 wrote to memory of 1056	1200	cf77690d2d383b1439dc78861594c26973b892ef30607a4f66e6e1da653f0614.exe	27
PID 1200 wrote to memory of 1056	1200	cf77690d2d383b1439dc78861594c26973b892ef30607a4f66e6e1da653f0614.exe	27
PID 1200 wrote to memory of 1056	1200	cf77690d2d383b1439dc78861594c26973b892ef30607a4f66e6e1da653f0614.exe	27
PID 1200 wrote to memory of 1056	1200	cf77690d2d383b1439dc78861594c26973b892ef30607a4f66e6e1da653f0614.exe	27
PID 1200 wrote to memory of 1056	1200	cf77690d2d383b1439dc78861594c26973b892ef30607a4f66e6e1da653f0614.exe	27
PID 1200 wrote to memory of 1056	1200	cf77690d2d383b1439dc78861594c26973b892ef30607a4f66e6e1da653f0614.exe	27
PID 1200 wrote to memory of 1056	1200	cf77690d2d383b1439dc78861594c26973b892ef30607a4f66e6e1da653f0614.exe	27
PID 1200 wrote to memory of 668	1200	cf77690d2d383b1439dc78861594c26973b892ef30607a4f66e6e1da653f0614.exe	28
PID 1200 wrote to memory of 668	1200	cf77690d2d383b1439dc78861594c26973b892ef30607a4f66e6e1da653f0614.exe	28
PID 1200 wrote to memory of 668	1200	cf77690d2d383b1439dc78861594c26973b892ef30607a4f66e6e1da653f0614.exe	28
PID 1200 wrote to memory of 668	1200	cf77690d2d383b1439dc78861594c26973b892ef30607a4f66e6e1da653f0614.exe	28

C:\Users\Admin\AppData\Local\Temp\cf77690d2d383b1439dc78861594c26973b892ef30607a4f66e6e1da653f0614.exe
"C:\Users\Admin\AppData\Local\Temp\cf77690d2d383b1439dc78861594c26973b892ef30607a4f66e6e1da653f0614.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Local\Temp\cf77690d2d383b1439dc78861594c26973b892ef30607a4f66e6e1da653f0614.exe
  2⤵
  PID:1056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 192
  2⤵
  - Program crash
  PID:668

memory/1056-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1056-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1056-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1056-60-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1056-64-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1056-65-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/1056-66-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1056-67-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download