618d5757cf057b15ac4608340b2c7f641bf56661da501b5084b0fa9212a1dcfd

Analysis

max time kernel
149s
max time network
34s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
03/07/2023, 12:55

Target

47d27bb5f4a208f3081471d00e87d1e4.exe
Size

3.5MB
MD5

47d27bb5f4a208f3081471d00e87d1e4
SHA1

472bb042dc730fddad7d4dd3b48d4369de463845
SHA256

618d5757cf057b15ac4608340b2c7f641bf56661da501b5084b0fa9212a1dcfd
SHA512

fe5acc6c508b77beb34d076b1f58ce17d77101454fdbf6cab573e3cffda683307fdb96979b6d09ad8c4fb09bf89cebb0a2bfabfb0c6f59193a228276be2c5cb5
SSDEEP

24576:wtpH9qTz57hM4/btkcXoTYMl6cexqJJnDIT69NyvONbeKtppAFZg+v:qM57hr7+MxqJJnsT69dbeKtp4

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2032 set thread context of 1112	2032	47d27bb5f4a208f3081471d00e87d1e4.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1212	2032	WerFault.exe	27

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1112	2032	47d27bb5f4a208f3081471d00e87d1e4.exe	28
PID 2032 wrote to memory of 1112	2032	47d27bb5f4a208f3081471d00e87d1e4.exe	28
PID 2032 wrote to memory of 1112	2032	47d27bb5f4a208f3081471d00e87d1e4.exe	28
PID 2032 wrote to memory of 1112	2032	47d27bb5f4a208f3081471d00e87d1e4.exe	28
PID 2032 wrote to memory of 1112	2032	47d27bb5f4a208f3081471d00e87d1e4.exe	28
PID 2032 wrote to memory of 1112	2032	47d27bb5f4a208f3081471d00e87d1e4.exe	28
PID 2032 wrote to memory of 1112	2032	47d27bb5f4a208f3081471d00e87d1e4.exe	28
PID 2032 wrote to memory of 1112	2032	47d27bb5f4a208f3081471d00e87d1e4.exe	28
PID 2032 wrote to memory of 1112	2032	47d27bb5f4a208f3081471d00e87d1e4.exe	28
PID 2032 wrote to memory of 1212	2032	47d27bb5f4a208f3081471d00e87d1e4.exe	30
PID 2032 wrote to memory of 1212	2032	47d27bb5f4a208f3081471d00e87d1e4.exe	30
PID 2032 wrote to memory of 1212	2032	47d27bb5f4a208f3081471d00e87d1e4.exe	30
PID 2032 wrote to memory of 1212	2032	47d27bb5f4a208f3081471d00e87d1e4.exe	30

C:\Users\Admin\AppData\Local\Temp\47d27bb5f4a208f3081471d00e87d1e4.exe
"C:\Users\Admin\AppData\Local\Temp\47d27bb5f4a208f3081471d00e87d1e4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 104
  2⤵
  - Program crash
  PID:1212

memory/1112-54-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/1112-55-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/1112-72-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1112-75-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/1112-77-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/1112-79-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/2032-89-0x0000000000DA0000-0x0000000001158000-memory.dmp

Filesize
3.7MB

Download