f7b3caf96d26314be264310c3440d238a22205e841c3991b508a920ac430d4b3

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10-06-2023 04:48

Target

f7b3caf96d26314be264310c3440d238a22205e841c3991b508a920ac430d4b3.exe
Size

366KB
MD5

df3795e6842e839cf45e694b7164ee17
SHA1

7e4759a3f10adbea349df5be94c96cbf327e4ce7
SHA256

f7b3caf96d26314be264310c3440d238a22205e841c3991b508a920ac430d4b3
SHA512

769c3870e0733ec32180116f08afe31aeaf8d2a195c05ec4cf5c677d3be20a9a7c27f1001a17be3409de8a6e05207f07eb63be98eefa707030773152b2fd37f7
SSDEEP

6144:i1gh1VbPonZFGyykMuMn3ui8JLy74qbSIpHCbeIEnrTNx:i18OAyyk/23+JG74qbZikFx

Score

8^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

f7b3caf96d26314be264310c3440d238a22205e841c3991b508a920ac430d4b3.exe

description	pid	process	target process
PID 1376 set thread context of 1404	1376	f7b3caf96d26314be264310c3440d238a22205e841c3991b508a920ac430d4b3.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

f7b3caf96d26314be264310c3440d238a22205e841c3991b508a920ac430d4b3.exe

description	pid	process	target process
PID 1376 wrote to memory of 1404	1376	f7b3caf96d26314be264310c3440d238a22205e841c3991b508a920ac430d4b3.exe	AppLaunch.exe
PID 1376 wrote to memory of 1404	1376	f7b3caf96d26314be264310c3440d238a22205e841c3991b508a920ac430d4b3.exe	AppLaunch.exe
PID 1376 wrote to memory of 1404	1376	f7b3caf96d26314be264310c3440d238a22205e841c3991b508a920ac430d4b3.exe	AppLaunch.exe
PID 1376 wrote to memory of 1404	1376	f7b3caf96d26314be264310c3440d238a22205e841c3991b508a920ac430d4b3.exe	AppLaunch.exe
PID 1376 wrote to memory of 1404	1376	f7b3caf96d26314be264310c3440d238a22205e841c3991b508a920ac430d4b3.exe	AppLaunch.exe
PID 1376 wrote to memory of 1404	1376	f7b3caf96d26314be264310c3440d238a22205e841c3991b508a920ac430d4b3.exe	AppLaunch.exe
PID 1376 wrote to memory of 1404	1376	f7b3caf96d26314be264310c3440d238a22205e841c3991b508a920ac430d4b3.exe	AppLaunch.exe
PID 1376 wrote to memory of 1404	1376	f7b3caf96d26314be264310c3440d238a22205e841c3991b508a920ac430d4b3.exe	AppLaunch.exe
PID 1376 wrote to memory of 1404	1376	f7b3caf96d26314be264310c3440d238a22205e841c3991b508a920ac430d4b3.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:1404

memory/1404-55-0x00000000000B0000-0x00000000000FB000-memory.dmp

Filesize
300KB

Download
memory/1404-56-0x00000000000B0000-0x00000000000FB000-memory.dmp

Filesize
300KB

Download
memory/1404-61-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1404-63-0x00000000000B0000-0x00000000000FB000-memory.dmp

Filesize
300KB

Download
memory/1404-64-0x00000000000B0000-0x00000000000FB000-memory.dmp

Filesize
300KB

Download