57f323470d018b0714f9d928ff7d0424e3c3622d65ce33711d6f556c30f92884

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19-09-2023 06:52

Target

k7432982.exe
Size

393KB
MD5

383bee6167a05d96266c75c521797494
SHA1

67815b143c0d3dab12da5a0c3ec34211b104400d
SHA256

57f323470d018b0714f9d928ff7d0424e3c3622d65ce33711d6f556c30f92884
SHA512

97790113a18df17bf3a96e4ebb3bb58599796b23d73d99425558d2aea089a14d0d9f5997a8ac1bc1b86591041d689c06f47169f0ab53f9d6f6f05ea33cbb235a
SSDEEP

12288:njFIqiG59ounkpxTDmQTaUNBY5/XQ/V1Sa:njFL52xTDraEY5/XQ/Vs

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

k7432982.exe

description pid process target process

PID 2068 set thread context of 2248 2068 k7432982.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1064 2248 WerFault.exe AppLaunch.exe

description	pid	process	target process
PID 2068 set thread context of 2248	2068	k7432982.exe	AppLaunch.exe

pid	pid_target	process	target process
1064	2248	WerFault.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

k7432982.exeAppLaunch.exe

description	pid	process	target process
PID 2068 wrote to memory of 2248	2068	k7432982.exe	AppLaunch.exe
PID 2068 wrote to memory of 2248	2068	k7432982.exe	AppLaunch.exe
PID 2068 wrote to memory of 2248	2068	k7432982.exe	AppLaunch.exe
PID 2068 wrote to memory of 2248	2068	k7432982.exe	AppLaunch.exe
PID 2068 wrote to memory of 2248	2068	k7432982.exe	AppLaunch.exe
PID 2068 wrote to memory of 2248	2068	k7432982.exe	AppLaunch.exe
PID 2068 wrote to memory of 2248	2068	k7432982.exe	AppLaunch.exe
PID 2068 wrote to memory of 2248	2068	k7432982.exe	AppLaunch.exe
PID 2068 wrote to memory of 2248	2068	k7432982.exe	AppLaunch.exe
PID 2068 wrote to memory of 2248	2068	k7432982.exe	AppLaunch.exe
PID 2068 wrote to memory of 2248	2068	k7432982.exe	AppLaunch.exe
PID 2068 wrote to memory of 2248	2068	k7432982.exe	AppLaunch.exe
PID 2068 wrote to memory of 2248	2068	k7432982.exe	AppLaunch.exe
PID 2068 wrote to memory of 2248	2068	k7432982.exe	AppLaunch.exe
PID 2248 wrote to memory of 1064	2248	AppLaunch.exe	WerFault.exe
PID 2248 wrote to memory of 1064	2248	AppLaunch.exe	WerFault.exe
PID 2248 wrote to memory of 1064	2248	AppLaunch.exe	WerFault.exe
PID 2248 wrote to memory of 1064	2248	AppLaunch.exe	WerFault.exe
PID 2248 wrote to memory of 1064	2248	AppLaunch.exe	WerFault.exe
PID 2248 wrote to memory of 1064	2248	AppLaunch.exe	WerFault.exe
PID 2248 wrote to memory of 1064	2248	AppLaunch.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\k7432982.exe
"C:\Users\Admin\AppData\Local\Temp\k7432982.exe"
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2068

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
- Suspicious use of WriteProcessMemory
PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 196
- Program crash
PID:1064

memory/2248-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2248-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2248-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2248-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2248-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2248-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2248-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2248-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2248-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2248-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download