a9647217d1fc12e9d5b604f9c20c99c1dbe6af00e90344106107a2878cce75ee

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 09:39

Target

a9647217d1fc12e9d5b604f9c20c99c1dbe6af00e90344106107a2878cce75ee.exe
Size

112KB
MD5

45fb6b5d9596ec2ca5bd27a2fbbfa9d1
SHA1

49a7d2560575dcde090c989973d7f79be93fa163
SHA256

a9647217d1fc12e9d5b604f9c20c99c1dbe6af00e90344106107a2878cce75ee
SHA512

5153eb495fcdb575bff495af7f8e318ff9c444b9857c24c8270936ca571cc666d7f086cbc89764b3941db22bead8f6909ec363bc04f1ef3eef1cfe2e54e5774f
SSDEEP

192:yJrsdMQf81eUAlIi1oynvRWq119ZwgoruW66cpz/rqbXSHLI5e/yrA:5T85li1bL1j5N/rqbCr3Kr

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1720 set thread context of 1300	1720	a9647217d1fc12e9d5b604f9c20c99c1dbe6af00e90344106107a2878cce75ee.exe	27

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1808	1720	WerFault.exe	26

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1300	1720	a9647217d1fc12e9d5b604f9c20c99c1dbe6af00e90344106107a2878cce75ee.exe	27
PID 1720 wrote to memory of 1300	1720	a9647217d1fc12e9d5b604f9c20c99c1dbe6af00e90344106107a2878cce75ee.exe	27
PID 1720 wrote to memory of 1300	1720	a9647217d1fc12e9d5b604f9c20c99c1dbe6af00e90344106107a2878cce75ee.exe	27
PID 1720 wrote to memory of 1300	1720	a9647217d1fc12e9d5b604f9c20c99c1dbe6af00e90344106107a2878cce75ee.exe	27
PID 1720 wrote to memory of 1300	1720	a9647217d1fc12e9d5b604f9c20c99c1dbe6af00e90344106107a2878cce75ee.exe	27
PID 1720 wrote to memory of 1300	1720	a9647217d1fc12e9d5b604f9c20c99c1dbe6af00e90344106107a2878cce75ee.exe	27
PID 1720 wrote to memory of 1300	1720	a9647217d1fc12e9d5b604f9c20c99c1dbe6af00e90344106107a2878cce75ee.exe	27
PID 1720 wrote to memory of 1300	1720	a9647217d1fc12e9d5b604f9c20c99c1dbe6af00e90344106107a2878cce75ee.exe	27
PID 1720 wrote to memory of 1300	1720	a9647217d1fc12e9d5b604f9c20c99c1dbe6af00e90344106107a2878cce75ee.exe	27
PID 1720 wrote to memory of 1808	1720	a9647217d1fc12e9d5b604f9c20c99c1dbe6af00e90344106107a2878cce75ee.exe	28
PID 1720 wrote to memory of 1808	1720	a9647217d1fc12e9d5b604f9c20c99c1dbe6af00e90344106107a2878cce75ee.exe	28
PID 1720 wrote to memory of 1808	1720	a9647217d1fc12e9d5b604f9c20c99c1dbe6af00e90344106107a2878cce75ee.exe	28
PID 1720 wrote to memory of 1808	1720	a9647217d1fc12e9d5b604f9c20c99c1dbe6af00e90344106107a2878cce75ee.exe	28

C:\Users\Admin\AppData\Local\Temp\a9647217d1fc12e9d5b604f9c20c99c1dbe6af00e90344106107a2878cce75ee.exe
"C:\Users\Admin\AppData\Local\Temp\a9647217d1fc12e9d5b604f9c20c99c1dbe6af00e90344106107a2878cce75ee.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Users\Admin\AppData\Local\Temp\a9647217d1fc12e9d5b604f9c20c99c1dbe6af00e90344106107a2878cce75ee.exe
  "C:\Users\Admin\AppData\Local\Temp\a9647217d1fc12e9d5b604f9c20c99c1dbe6af00e90344106107a2878cce75ee.exe"
  2⤵
  PID:1300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 156
  2⤵
  - Program crash
  PID:1808

memory/1300-54-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1300-55-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1300-57-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1300-58-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1300-59-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1720-61-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1720-62-0x0000000000220000-0x0000000000243000-memory.dmp

Filesize
140KB

Download
memory/1720-63-0x0000000000220000-0x0000000000243000-memory.dmp

Filesize
140KB

Download