84be47f95a3422f33b93fa9549b916885ff113258f21c13aa2ffbab7aea5cfd4

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
22-08-2023 22:52

Target

CupFixer.exe
Size

8.7MB
MD5

1f2ef76d1e445de858ded5a0b2834630
SHA1

03d0bdfbfc8069fc057e5c70a2a9d0e8a37c5576
SHA256

84be47f95a3422f33b93fa9549b916885ff113258f21c13aa2ffbab7aea5cfd4
SHA512

ffc92eadbb7469c86c6087bdb41a5767bd138ad76123b03acecf19e2a95cc4456e4ef39719dd2df45b365e1eac1c252b7a8254fb2db691674a26c68a57b58eda
SSDEEP

196608:XUJlpPbv3H6bESgmATk/Pesw3ixXnhoy42CHo9g8BmOxxZrYPBNFYIX:XUJPebpgmATkcIXKH2oo9g8IOxxW3e

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2560	CupFixer.exe
2560	CupFixer.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2452	2560	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2064	2560	CupFixer.exe	29
PID 2560 wrote to memory of 2064	2560	CupFixer.exe	29
PID 2560 wrote to memory of 2064	2560	CupFixer.exe	29
PID 2560 wrote to memory of 2452	2560	CupFixer.exe	30
PID 2560 wrote to memory of 2452	2560	CupFixer.exe	30
PID 2560 wrote to memory of 2452	2560	CupFixer.exe	30

C:\Users\Admin\AppData\Local\Temp\CupFixer.exe
"C:\Users\Admin\AppData\Local\Temp\CupFixer.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2064
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2560 -s 376
  2⤵
  - Program crash
  PID:2452

memory/2560-54-0x000000013F6F0000-0x00000001424CD000-memory.dmp

Filesize
45.9MB

Download
memory/2560-57-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2560-56-0x000000013F6F0000-0x00000001424CD000-memory.dmp

Filesize
45.9MB

Download
memory/2560-58-0x000000013F6F0000-0x00000001424CD000-memory.dmp

Filesize
45.9MB

Download
memory/2560-59-0x000000013F6F0000-0x00000001424CD000-memory.dmp

Filesize
45.9MB

Download
memory/2560-60-0x000000013F6F0000-0x00000001424CD000-memory.dmp

Filesize
45.9MB

Download
memory/2560-62-0x0000000001F70000-0x0000000001F80000-memory.dmp

Filesize
64KB

Download
memory/2560-61-0x0000000077140000-0x00000000772E9000-memory.dmp

Filesize
1.7MB

Download
memory/2560-63-0x00000000772F0000-0x0000000077300000-memory.dmp

Filesize
64KB

Download
memory/2560-64-0x000000013F6F0000-0x00000001424CD000-memory.dmp

Filesize
45.9MB

Download
memory/2560-65-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2560-66-0x0000000077140000-0x00000000772E9000-memory.dmp

Filesize
1.7MB

Download