8e12d8cb25a85392d8e14d429b725c635776731d1546ad5d8c88afb09e8e2856

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16/06/2023, 04:21

Target

8adb6bf170d9e58bd51021619c8d74a0.exe
Size

3.0MB
MD5

8adb6bf170d9e58bd51021619c8d74a0
SHA1

fe37f27bb1c348e21ff0f656ed3efd100627f199
SHA256

8e12d8cb25a85392d8e14d429b725c635776731d1546ad5d8c88afb09e8e2856
SHA512

63e50768c6c057f6fca5855827adcfcaef198b67dd6fa3f874278cf0a6937ad4dec0d26e366ac3873aa92aee1510acb632b188af8031502d9382fb0e0140d3da
SSDEEP

98304:0ahXe72/ZtsBYxnI+mO39DhslFZgypfOcdqVlkRYFu:ORY

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 928 set thread context of 672	928	8adb6bf170d9e58bd51021619c8d74a0.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1156	928	WerFault.exe	27

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 880	928	8adb6bf170d9e58bd51021619c8d74a0.exe	29
PID 928 wrote to memory of 880	928	8adb6bf170d9e58bd51021619c8d74a0.exe	29
PID 928 wrote to memory of 880	928	8adb6bf170d9e58bd51021619c8d74a0.exe	29
PID 928 wrote to memory of 880	928	8adb6bf170d9e58bd51021619c8d74a0.exe	29
PID 928 wrote to memory of 880	928	8adb6bf170d9e58bd51021619c8d74a0.exe	29
PID 928 wrote to memory of 880	928	8adb6bf170d9e58bd51021619c8d74a0.exe	29
PID 928 wrote to memory of 880	928	8adb6bf170d9e58bd51021619c8d74a0.exe	29
PID 928 wrote to memory of 672	928	8adb6bf170d9e58bd51021619c8d74a0.exe	30
PID 928 wrote to memory of 672	928	8adb6bf170d9e58bd51021619c8d74a0.exe	30
PID 928 wrote to memory of 672	928	8adb6bf170d9e58bd51021619c8d74a0.exe	30
PID 928 wrote to memory of 672	928	8adb6bf170d9e58bd51021619c8d74a0.exe	30
PID 928 wrote to memory of 672	928	8adb6bf170d9e58bd51021619c8d74a0.exe	30
PID 928 wrote to memory of 672	928	8adb6bf170d9e58bd51021619c8d74a0.exe	30
PID 928 wrote to memory of 672	928	8adb6bf170d9e58bd51021619c8d74a0.exe	30
PID 928 wrote to memory of 672	928	8adb6bf170d9e58bd51021619c8d74a0.exe	30
PID 928 wrote to memory of 672	928	8adb6bf170d9e58bd51021619c8d74a0.exe	30
PID 928 wrote to memory of 1156	928	8adb6bf170d9e58bd51021619c8d74a0.exe	31
PID 928 wrote to memory of 1156	928	8adb6bf170d9e58bd51021619c8d74a0.exe	31
PID 928 wrote to memory of 1156	928	8adb6bf170d9e58bd51021619c8d74a0.exe	31
PID 928 wrote to memory of 1156	928	8adb6bf170d9e58bd51021619c8d74a0.exe	31

C:\Users\Admin\AppData\Local\Temp\8adb6bf170d9e58bd51021619c8d74a0.exe
"C:\Users\Admin\AppData\Local\Temp\8adb6bf170d9e58bd51021619c8d74a0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:928
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:880
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 96
  2⤵
  - Program crash
  PID:1156

memory/672-54-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/672-55-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/672-72-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download