504aba9ffc85b963c92b2725c54b2f16e8dca913b5dbe2b7d75786eee3692a38

Analysis

max time kernel
246s
max time network
356s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 09:08

Target

©ɱ/017.exe
Size

76KB
MD5

1f925776bac8f82128ce4b41a701aad0
SHA1

0d5e8140a716e5d1a359a1987e65be5deee5babe
SHA256

febb76aced959da4cb40998f8044bb56fd5b960e70de31b550d1b1001fc767ec
SHA512

6e8412d116232266a0d8627d4f1ba341ce4e5eb8647eb3099c2ee08a4fb60ead1981d86ff17218a002fee495e335f2f2ca0ffa8f80e7cf751d25cae03d91b43c
SSDEEP

1536:pEJRYIcj8rqtnPoqTmfaD5DgnpyGgUF5cDYMv:pCcwrK3T+aDWpfgUov

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

017.exe

description pid process target process

PID 552 set thread context of 784 552 017.exe 017.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1560 784 WerFault.exe 017.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

017.exe

pid process

552 017.exe
552 017.exe

description	pid	process	target process
PID 552 set thread context of 784	552	017.exe	017.exe

pid	pid_target	process	target process
1560	784	WerFault.exe	017.exe

pid	process
552	017.exe
552	017.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

017.exe017.exe

description	pid	process	target process
PID 552 wrote to memory of 784	552	017.exe	017.exe
PID 552 wrote to memory of 784	552	017.exe	017.exe
PID 552 wrote to memory of 784	552	017.exe	017.exe
PID 552 wrote to memory of 784	552	017.exe	017.exe
PID 552 wrote to memory of 784	552	017.exe	017.exe
PID 552 wrote to memory of 784	552	017.exe	017.exe
PID 552 wrote to memory of 784	552	017.exe	017.exe
PID 552 wrote to memory of 784	552	017.exe	017.exe
PID 552 wrote to memory of 784	552	017.exe	017.exe
PID 784 wrote to memory of 1560	784	017.exe	WerFault.exe
PID 784 wrote to memory of 1560	784	017.exe	WerFault.exe
PID 784 wrote to memory of 1560	784	017.exe	WerFault.exe
PID 784 wrote to memory of 1560	784	017.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\©ɱ\017.exe
C:\Users\Admin\AppData\Local\Temp\©ɱ\017.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 784 -s 480
3⤵
- Program crash
PID:1560

memory/552-54-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download
memory/552-62-0x0000000000230000-0x0000000000234000-memory.dmp

Filesize
16KB

Download
memory/784-55-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/784-56-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/784-58-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/784-59-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/784-60-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/784-61-0x000000000040595B-mapping.dmp

Download
memory/784-65-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1560-66-0x0000000000000000-mapping.dmp

Download