d64a19680a0c40167e629e7b8a7ecc758287c708ed40456fe8adb31618315bc3

Analysis

max time kernel
1s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 11:45

Target

d64a19680a0c40167e629e7b8a7ecc758287c708ed40456fe8adb31618315bc3.exe
Size

863KB
MD5

a8bb9020a16984ceaf091768837a21ee
SHA1

c8bd362eec490868618ad736080d9ef1e2a83649
SHA256

d64a19680a0c40167e629e7b8a7ecc758287c708ed40456fe8adb31618315bc3
SHA512

cb9d39b11613e0e06c5542ac7da8df89ea4c27a245a0ab8b4adc155b56d92e83f3ef4114027e27c74a9cf4f9e9dd56b8ef46249147f52dc2add717c5d3952be3
SSDEEP

24576:DJ+gF1tTyyTW7CpC0OLbkkyBwNm3bgMH6WbY9N:DJHYLmpmLpy2mqWbYL

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1956 set thread context of 960	1956	d64a19680a0c40167e629e7b8a7ecc758287c708ed40456fe8adb31618315bc3.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
828	960	WerFault.exe	28

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 960	1956	d64a19680a0c40167e629e7b8a7ecc758287c708ed40456fe8adb31618315bc3.exe	28
PID 1956 wrote to memory of 960	1956	d64a19680a0c40167e629e7b8a7ecc758287c708ed40456fe8adb31618315bc3.exe	28
PID 1956 wrote to memory of 960	1956	d64a19680a0c40167e629e7b8a7ecc758287c708ed40456fe8adb31618315bc3.exe	28
PID 1956 wrote to memory of 960	1956	d64a19680a0c40167e629e7b8a7ecc758287c708ed40456fe8adb31618315bc3.exe	28
PID 1956 wrote to memory of 960	1956	d64a19680a0c40167e629e7b8a7ecc758287c708ed40456fe8adb31618315bc3.exe	28
PID 1956 wrote to memory of 960	1956	d64a19680a0c40167e629e7b8a7ecc758287c708ed40456fe8adb31618315bc3.exe	28
PID 960 wrote to memory of 828	960	d64a19680a0c40167e629e7b8a7ecc758287c708ed40456fe8adb31618315bc3.exe	29
PID 960 wrote to memory of 828	960	d64a19680a0c40167e629e7b8a7ecc758287c708ed40456fe8adb31618315bc3.exe	29
PID 960 wrote to memory of 828	960	d64a19680a0c40167e629e7b8a7ecc758287c708ed40456fe8adb31618315bc3.exe	29
PID 960 wrote to memory of 828	960	d64a19680a0c40167e629e7b8a7ecc758287c708ed40456fe8adb31618315bc3.exe	29

memory/960-54-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/960-56-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/960-59-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download