9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed

Analysis

max time kernel
41s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 23:52

Target

9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe
Size

61KB
MD5

d017cbc39ba2ce43c9dba5640f1e20ba
SHA1

e6c069f31a7d169525cb8ba6d4f0ca7ac48ce4c5
SHA256

9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed
SHA512

d66f08bfbaa6bf813eb8a6e9a8237e09ec74529ad5d9fb2e7d5c6bee078544ca29b4f5366772a1f8bf14024c78587f65b951371750660efe0f32d2f6ce108dcf
SSDEEP

768:/x+hcXiL6ys843c0p9+0eLQilUGKn2oAq/QQ50G+7kUOM+suupICPIztzK:/xscXuk/Mq9+hLQuK2lq//EOszpwG

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1516 set thread context of 1540	1516	9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe	27

Program crash 1 IoCs

pid	pid_target	Process	procid_target
668	1516	WerFault.exe	26

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1516	9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 1540	1516	9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe	27
PID 1516 wrote to memory of 1540	1516	9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe	27
PID 1516 wrote to memory of 1540	1516	9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe	27
PID 1516 wrote to memory of 1540	1516	9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe	27
PID 1516 wrote to memory of 1540	1516	9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe	27
PID 1516 wrote to memory of 1540	1516	9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe	27
PID 1516 wrote to memory of 1540	1516	9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe	27
PID 1516 wrote to memory of 1540	1516	9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe	27
PID 1516 wrote to memory of 668	1516	9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe	28
PID 1516 wrote to memory of 668	1516	9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe	28
PID 1516 wrote to memory of 668	1516	9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe	28
PID 1516 wrote to memory of 668	1516	9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe	28

C:\Users\Admin\AppData\Local\Temp\9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe
"C:\Users\Admin\AppData\Local\Temp\9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Users\Admin\AppData\Local\Temp\9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe
  C:\Users\Admin\AppData\Local\Temp\9d7bad93dca992131c5a6f5615af9b3b941a364399f8e3056bba63116e58d1ed.exe
  2⤵
  PID:1540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 192
  2⤵
  - Program crash
  PID:668

memory/1516-66-0x0000000000400000-0x0000000000409001-memory.dmp

Filesize
36KB

Download
memory/1516-67-0x0000000000230000-0x000000000023A000-memory.dmp

Filesize
40KB

Download
memory/1516-71-0x0000000000230000-0x000000000023A000-memory.dmp

Filesize
40KB

Download
memory/1540-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1540-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1540-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1540-68-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1540-69-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download
memory/1540-70-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download