1f1b8f4b7f148de3f489277914f06ba6228fb7bea8ef497cb75c2144e4e2b28b

Resubmissions

21-09-2023 07:12

19-09-2023 06:52

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19-09-2023 06:52

Target

k8684673.exe
Size

371KB
MD5

92d7903295eeca59b8ccd1f6299eda7b
SHA1

4555db3293cc8498017b58eb6fd5fabc0073f94e
SHA256

1f1b8f4b7f148de3f489277914f06ba6228fb7bea8ef497cb75c2144e4e2b28b
SHA512

5c5ba099e60a15b4339b214f83f68faaceddfc91b67f89295899233d4b10e1d74cde2a6e9bd81a8a20c3857eed6ad0c7e52a98dede8768ba8d7d6abf172ff29a
SSDEEP

6144:YwvJm09zORs+z/TMify9DAOUgQls0fqfmZ0kfMFX3aBsNYWNNWL+TI8eIttm8/:Ygw09CK5NTgs/xRjNYWNG+/eIi8/

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

k8684673.exe

description pid process target process

PID 2232 set thread context of 3000 2232 k8684673.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2828 3000 WerFault.exe AppLaunch.exe

description	pid	process	target process
PID 2232 set thread context of 3000	2232	k8684673.exe	AppLaunch.exe

pid	pid_target	process	target process
2828	3000	WerFault.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

k8684673.exeAppLaunch.exe

description	pid	process	target process
PID 2232 wrote to memory of 3000	2232	k8684673.exe	AppLaunch.exe
PID 2232 wrote to memory of 3000	2232	k8684673.exe	AppLaunch.exe
PID 2232 wrote to memory of 3000	2232	k8684673.exe	AppLaunch.exe
PID 2232 wrote to memory of 3000	2232	k8684673.exe	AppLaunch.exe
PID 2232 wrote to memory of 3000	2232	k8684673.exe	AppLaunch.exe
PID 2232 wrote to memory of 3000	2232	k8684673.exe	AppLaunch.exe
PID 2232 wrote to memory of 3000	2232	k8684673.exe	AppLaunch.exe
PID 2232 wrote to memory of 3000	2232	k8684673.exe	AppLaunch.exe
PID 2232 wrote to memory of 3000	2232	k8684673.exe	AppLaunch.exe
PID 2232 wrote to memory of 3000	2232	k8684673.exe	AppLaunch.exe
PID 2232 wrote to memory of 3000	2232	k8684673.exe	AppLaunch.exe
PID 2232 wrote to memory of 3000	2232	k8684673.exe	AppLaunch.exe
PID 2232 wrote to memory of 3000	2232	k8684673.exe	AppLaunch.exe
PID 2232 wrote to memory of 3000	2232	k8684673.exe	AppLaunch.exe
PID 3000 wrote to memory of 2828	3000	AppLaunch.exe	WerFault.exe
PID 3000 wrote to memory of 2828	3000	AppLaunch.exe	WerFault.exe
PID 3000 wrote to memory of 2828	3000	AppLaunch.exe	WerFault.exe
PID 3000 wrote to memory of 2828	3000	AppLaunch.exe	WerFault.exe
PID 3000 wrote to memory of 2828	3000	AppLaunch.exe	WerFault.exe
PID 3000 wrote to memory of 2828	3000	AppLaunch.exe	WerFault.exe
PID 3000 wrote to memory of 2828	3000	AppLaunch.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\k8684673.exe
"C:\Users\Admin\AppData\Local\Temp\k8684673.exe"
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2232

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
- Suspicious use of WriteProcessMemory
PID:3000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 196
- Program crash
PID:2828

memory/3000-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3000-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3000-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3000-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3000-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3000-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3000-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3000-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3000-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3000-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download