f502c23194f3f42f469749862ec1743599af49a37512dbc012aad53521692d0f

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 16:05

Target

f502c23194f3f42f469749862ec1743599af49a37512dbc012aad53521692d0f.exe
Size

124KB
MD5

fc611c8670f002fb108885f35b8b9aca
SHA1

e095720a74f3d372327aa033464401bf959a4e47
SHA256

f502c23194f3f42f469749862ec1743599af49a37512dbc012aad53521692d0f
SHA512

02629b0ddbb3d38d1f33be80c9eaab5edd406e264e19650626121862459ad0fa95af7da3a659bdfac3b155ef7b1dbcb4d71838649fc16ad18f56456633580140
SSDEEP

3072:DMyCuFTQjmqgg94jQe9O53T960u/M6iz8EmsU7Ydb7l:nFumf9qj96lVu8Xcb7l

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1800 set thread context of 2012	1800	f502c23194f3f42f469749862ec1743599af49a37512dbc012aad53521692d0f.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
944	2012	WerFault.exe	28

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2012	1800	f502c23194f3f42f469749862ec1743599af49a37512dbc012aad53521692d0f.exe	28
PID 1800 wrote to memory of 2012	1800	f502c23194f3f42f469749862ec1743599af49a37512dbc012aad53521692d0f.exe	28
PID 1800 wrote to memory of 2012	1800	f502c23194f3f42f469749862ec1743599af49a37512dbc012aad53521692d0f.exe	28
PID 1800 wrote to memory of 2012	1800	f502c23194f3f42f469749862ec1743599af49a37512dbc012aad53521692d0f.exe	28
PID 1800 wrote to memory of 2012	1800	f502c23194f3f42f469749862ec1743599af49a37512dbc012aad53521692d0f.exe	28
PID 1800 wrote to memory of 2012	1800	f502c23194f3f42f469749862ec1743599af49a37512dbc012aad53521692d0f.exe	28
PID 1800 wrote to memory of 2012	1800	f502c23194f3f42f469749862ec1743599af49a37512dbc012aad53521692d0f.exe	28
PID 1800 wrote to memory of 2012	1800	f502c23194f3f42f469749862ec1743599af49a37512dbc012aad53521692d0f.exe	28
PID 1800 wrote to memory of 2012	1800	f502c23194f3f42f469749862ec1743599af49a37512dbc012aad53521692d0f.exe	28
PID 2012 wrote to memory of 944	2012	f502c23194f3f42f469749862ec1743599af49a37512dbc012aad53521692d0f.exe	29
PID 2012 wrote to memory of 944	2012	f502c23194f3f42f469749862ec1743599af49a37512dbc012aad53521692d0f.exe	29
PID 2012 wrote to memory of 944	2012	f502c23194f3f42f469749862ec1743599af49a37512dbc012aad53521692d0f.exe	29
PID 2012 wrote to memory of 944	2012	f502c23194f3f42f469749862ec1743599af49a37512dbc012aad53521692d0f.exe	29

memory/1800-66-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2012-54-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2012-55-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2012-57-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2012-60-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2012-63-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2012-67-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download