684fd07aed5b39102fecd7485856ef7471ced6e32296470fbd303be992cf06cc

Analysis

max time kernel
44s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 16:58

Target

684fd07aed5b39102fecd7485856ef7471ced6e32296470fbd303be992cf06cc.exe
Size

13.3MB
MD5

1c9d2305da12ca018eab0c91579935e0
SHA1

00e0a3d28b2841a540c34c16ded9438c2b343c50
SHA256

684fd07aed5b39102fecd7485856ef7471ced6e32296470fbd303be992cf06cc
SHA512

1e953affd0635eee82d41439da65af85284666637923d0f583d4866df44e75c1e586699052e3930e4a9a18c9a256fd269d0fbeb7014af4be2ec0d7ef7e2ec1e9
SSDEEP

196608:EsTj2H7TvL+ziIVwsHBAD2sCyKJdF3byv0ubVGHLH17KEIu2SljZ/T97lJdh80H1:52H3vL39DgyIFLyv0ukVGDq7bdJRFZV

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

684fd07aed5b39102fecd7485856ef7471ced6e32296470fbd303be992cf06cc.exe

pid process

2040 684fd07aed5b39102fecd7485856ef7471ced6e32296470fbd303be992cf06cc.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

300 2040 WerFault.exe 684fd07aed5b39102fecd7485856ef7471ced6e32296470fbd303be992cf06cc.exe

pid	process
2040	684fd07aed5b39102fecd7485856ef7471ced6e32296470fbd303be992cf06cc.exe

pid	pid_target	process	target process
300	2040	WerFault.exe	684fd07aed5b39102fecd7485856ef7471ced6e32296470fbd303be992cf06cc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

684fd07aed5b39102fecd7485856ef7471ced6e32296470fbd303be992cf06cc.exe

description	pid	process	target process
PID 2040 wrote to memory of 300	2040	684fd07aed5b39102fecd7485856ef7471ced6e32296470fbd303be992cf06cc.exe	WerFault.exe
PID 2040 wrote to memory of 300	2040	684fd07aed5b39102fecd7485856ef7471ced6e32296470fbd303be992cf06cc.exe	WerFault.exe
PID 2040 wrote to memory of 300	2040	684fd07aed5b39102fecd7485856ef7471ced6e32296470fbd303be992cf06cc.exe	WerFault.exe
PID 2040 wrote to memory of 300	2040	684fd07aed5b39102fecd7485856ef7471ced6e32296470fbd303be992cf06cc.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 524
2⤵
- Program crash
PID:300

memory/300-62-0x0000000000000000-mapping.dmp

Download
memory/2040-54-0x0000000002700000-0x000000000294D000-memory.dmp

Filesize
2.3MB

Download
memory/2040-55-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/2040-56-0x0000000002700000-0x000000000294D000-memory.dmp

Filesize
2.3MB

Download
memory/2040-57-0x0000000002700000-0x000000000294D000-memory.dmp

Filesize
2.3MB

Download
memory/2040-59-0x0000000000400000-0x00000000009B5000-memory.dmp

Filesize
5.7MB

Download
memory/2040-60-0x0000000002700000-0x000000000294D000-memory.dmp

Filesize
2.3MB

Download
memory/2040-61-0x0000000000400000-0x00000000009B5000-memory.dmp

Filesize
5.7MB

Download
memory/2040-63-0x0000000000400000-0x00000000009B5000-memory.dmp

Filesize
5.7MB

Download
memory/2040-64-0x0000000002700000-0x000000000294D000-memory.dmp

Filesize
2.3MB

Download