dde1c6c362953397b5b698c2b389b39e638473a1190e54ce03575fde39f244ab

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
18-09-2023 12:14

Target

file.exe
Size

371KB
MD5

d18372a9bed95a143ea42554ef5d743a
SHA1

e36a5c64b49e40481a6c5bb80c37a006b1a12a0a
SHA256

dde1c6c362953397b5b698c2b389b39e638473a1190e54ce03575fde39f244ab
SHA512

98f78553c5b6e44655700f4979752a88e0b7506a2d6c9a72ba3d00b12b22c3fa6c92dac4dc0741bfc59cc4a2ba685b5857a31d765d18846ac07f90f2a5f63f26
SSDEEP

6144:q0vJm09zORs+z/TMify9DAOugQa6WRYGsLecJCxm+vEp6ELp6wpH8/:qcw09CK5NBT6+YMcMDv1u6o8/

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3044 set thread context of 2420	3044	file.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2600	2420	WerFault.exe	29

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2440	3044	file.exe	28
PID 3044 wrote to memory of 2440	3044	file.exe	28
PID 3044 wrote to memory of 2440	3044	file.exe	28
PID 3044 wrote to memory of 2440	3044	file.exe	28
PID 3044 wrote to memory of 2440	3044	file.exe	28
PID 3044 wrote to memory of 2440	3044	file.exe	28
PID 3044 wrote to memory of 2440	3044	file.exe	28
PID 3044 wrote to memory of 2420	3044	file.exe	29
PID 3044 wrote to memory of 2420	3044	file.exe	29
PID 3044 wrote to memory of 2420	3044	file.exe	29
PID 3044 wrote to memory of 2420	3044	file.exe	29
PID 3044 wrote to memory of 2420	3044	file.exe	29
PID 3044 wrote to memory of 2420	3044	file.exe	29
PID 3044 wrote to memory of 2420	3044	file.exe	29
PID 3044 wrote to memory of 2420	3044	file.exe	29
PID 3044 wrote to memory of 2420	3044	file.exe	29
PID 3044 wrote to memory of 2420	3044	file.exe	29
PID 3044 wrote to memory of 2420	3044	file.exe	29
PID 3044 wrote to memory of 2420	3044	file.exe	29
PID 3044 wrote to memory of 2420	3044	file.exe	29
PID 3044 wrote to memory of 2420	3044	file.exe	29
PID 2420 wrote to memory of 2600	2420	AppLaunch.exe	30
PID 2420 wrote to memory of 2600	2420	AppLaunch.exe	30
PID 2420 wrote to memory of 2600	2420	AppLaunch.exe	30
PID 2420 wrote to memory of 2600	2420	AppLaunch.exe	30
PID 2420 wrote to memory of 2600	2420	AppLaunch.exe	30
PID 2420 wrote to memory of 2600	2420	AppLaunch.exe	30
PID 2420 wrote to memory of 2600	2420	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2440
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 196
    3⤵
    - Program crash
    PID:2600

memory/2420-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2420-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2420-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2420-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2420-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2420-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2420-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2420-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2420-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2420-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download