6c795ee120e550d487ce7ef8d4b4547f8d1264e7bdb5c1c546bea4b82982a031

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19-09-2023 01:25

Target

file.exe
Size

393KB
MD5

5a68b4497333ea491e54312b03d1f11b
SHA1

ccb20981ce68969ac67d072374ea4942616c248e
SHA256

6c795ee120e550d487ce7ef8d4b4547f8d1264e7bdb5c1c546bea4b82982a031
SHA512

a2e8845c19aa1272aebf7641dc5d5f3aeb17d34cd87ffb22c64bd818f6284923507a434adcaf2b2c558aca7c12e98b30c19fc3f15ea562611562d10edd4c2b96
SSDEEP

6144:tCXjEM2jicP5iOo2T8VrSd/sUAOXkls7st4dNxvhdS2UwMeRkX7IDuCSR0mB1Sa:tCXlqiG59ouxkoxrF5uCg1Sa

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1488 set thread context of 1968	1488	file.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1980	1968	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1968	1488	file.exe	29
PID 1488 wrote to memory of 1968	1488	file.exe	29
PID 1488 wrote to memory of 1968	1488	file.exe	29
PID 1488 wrote to memory of 1968	1488	file.exe	29
PID 1488 wrote to memory of 1968	1488	file.exe	29
PID 1488 wrote to memory of 1968	1488	file.exe	29
PID 1488 wrote to memory of 1968	1488	file.exe	29
PID 1488 wrote to memory of 1968	1488	file.exe	29
PID 1488 wrote to memory of 1968	1488	file.exe	29
PID 1488 wrote to memory of 1968	1488	file.exe	29
PID 1488 wrote to memory of 1968	1488	file.exe	29
PID 1488 wrote to memory of 1968	1488	file.exe	29
PID 1488 wrote to memory of 1968	1488	file.exe	29
PID 1488 wrote to memory of 1968	1488	file.exe	29
PID 1968 wrote to memory of 1980	1968	AppLaunch.exe	30
PID 1968 wrote to memory of 1980	1968	AppLaunch.exe	30
PID 1968 wrote to memory of 1980	1968	AppLaunch.exe	30
PID 1968 wrote to memory of 1980	1968	AppLaunch.exe	30
PID 1968 wrote to memory of 1980	1968	AppLaunch.exe	30
PID 1968 wrote to memory of 1980	1968	AppLaunch.exe	30
PID 1968 wrote to memory of 1980	1968	AppLaunch.exe	30

memory/1968-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1968-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1968-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1968-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1968-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1968-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1968-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1968-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1968-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1968-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download