ebc7a922a9207a481faf455e4261feff9e86b1eecb37c27d8f471b82c85ec122

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02/09/2023, 04:54

Target

ebc7a922a9207a481faf455e4261feff9e86b1eecb37c27d8f471b82c85ec122.exe
Size

322KB
MD5

756b0643cc3bc903185f3e6e9d0088bd
SHA1

cb762343b744668aeede87e83517b2b2ad67f6d4
SHA256

ebc7a922a9207a481faf455e4261feff9e86b1eecb37c27d8f471b82c85ec122
SHA512

02b5a619ee09efcff9976e94b88452b777db7240e5ed7cc9b3c804f2d17d5797137769d8f1b0ebe840508418144dd9a939b6cf9198e3d357e11097f5f72ed57c
SSDEEP

6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2444 set thread context of 3056	2444	ebc7a922a9207a481faf455e4261feff9e86b1eecb37c27d8f471b82c85ec122.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2180	3056	WerFault.exe	28

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 3056	2444	ebc7a922a9207a481faf455e4261feff9e86b1eecb37c27d8f471b82c85ec122.exe	28
PID 2444 wrote to memory of 3056	2444	ebc7a922a9207a481faf455e4261feff9e86b1eecb37c27d8f471b82c85ec122.exe	28
PID 2444 wrote to memory of 3056	2444	ebc7a922a9207a481faf455e4261feff9e86b1eecb37c27d8f471b82c85ec122.exe	28
PID 2444 wrote to memory of 3056	2444	ebc7a922a9207a481faf455e4261feff9e86b1eecb37c27d8f471b82c85ec122.exe	28
PID 2444 wrote to memory of 3056	2444	ebc7a922a9207a481faf455e4261feff9e86b1eecb37c27d8f471b82c85ec122.exe	28
PID 2444 wrote to memory of 3056	2444	ebc7a922a9207a481faf455e4261feff9e86b1eecb37c27d8f471b82c85ec122.exe	28
PID 2444 wrote to memory of 3056	2444	ebc7a922a9207a481faf455e4261feff9e86b1eecb37c27d8f471b82c85ec122.exe	28
PID 2444 wrote to memory of 3056	2444	ebc7a922a9207a481faf455e4261feff9e86b1eecb37c27d8f471b82c85ec122.exe	28
PID 2444 wrote to memory of 3056	2444	ebc7a922a9207a481faf455e4261feff9e86b1eecb37c27d8f471b82c85ec122.exe	28
PID 3056 wrote to memory of 2180	3056	ebc7a922a9207a481faf455e4261feff9e86b1eecb37c27d8f471b82c85ec122.exe	29
PID 3056 wrote to memory of 2180	3056	ebc7a922a9207a481faf455e4261feff9e86b1eecb37c27d8f471b82c85ec122.exe	29
PID 3056 wrote to memory of 2180	3056	ebc7a922a9207a481faf455e4261feff9e86b1eecb37c27d8f471b82c85ec122.exe	29
PID 3056 wrote to memory of 2180	3056	ebc7a922a9207a481faf455e4261feff9e86b1eecb37c27d8f471b82c85ec122.exe	29

memory/2444-0-0x0000000000A50000-0x0000000000AA6000-memory.dmp

Filesize
344KB

Download
memory/2444-1-0x00000000746D0000-0x0000000074DBE000-memory.dmp

Filesize
6.9MB

Download
memory/2444-2-0x00000000045E0000-0x00000000046AC000-memory.dmp

Filesize
816KB

Download
memory/2444-3-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2444-4-0x00000000048D0000-0x0000000004910000-memory.dmp

Filesize
256KB

Download
memory/2444-15-0x00000000746D0000-0x0000000074DBE000-memory.dmp

Filesize
6.9MB

Download
memory/3056-7-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3056-8-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3056-9-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3056-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3056-12-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3056-14-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3056-5-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download