5b5bbabb4c3ef9f465d1e8f2cf54cb097a3756b307b859cd0bf80691a618ead9

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19-09-2023 06:51

Target

k6689391.exe
Size

365KB
MD5

e3ea9776a8e23908e4fea6b03ed2fcc2
SHA1

11c90547ffe26b7e467c9447f5d7d5318aecc8d7
SHA256

5b5bbabb4c3ef9f465d1e8f2cf54cb097a3756b307b859cd0bf80691a618ead9
SHA512

7614da4d3d4a4fa3139a93da160f7f60a6aa331762edb35d6977f8e2a230be650c3a1c388de9997eb0dcc4e3ac0764ecbb8a173710dd392c69391e024e8cac58
SSDEEP

6144:PuejEA2jicP5iOo2T8VrSd/sUAOFUlHOehHOQDgLgsLsTJHYDvZcTYnNgzzlyAu5:PuetqiG59oufUttfgL/L2J/T3yAufx11

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3020 set thread context of 2576	3020	k6689391.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2416	2576	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2576	3020	k6689391.exe	29
PID 3020 wrote to memory of 2576	3020	k6689391.exe	29
PID 3020 wrote to memory of 2576	3020	k6689391.exe	29
PID 3020 wrote to memory of 2576	3020	k6689391.exe	29
PID 3020 wrote to memory of 2576	3020	k6689391.exe	29
PID 3020 wrote to memory of 2576	3020	k6689391.exe	29
PID 3020 wrote to memory of 2576	3020	k6689391.exe	29
PID 3020 wrote to memory of 2576	3020	k6689391.exe	29
PID 3020 wrote to memory of 2576	3020	k6689391.exe	29
PID 3020 wrote to memory of 2576	3020	k6689391.exe	29
PID 3020 wrote to memory of 2576	3020	k6689391.exe	29
PID 3020 wrote to memory of 2576	3020	k6689391.exe	29
PID 3020 wrote to memory of 2576	3020	k6689391.exe	29
PID 3020 wrote to memory of 2576	3020	k6689391.exe	29
PID 2576 wrote to memory of 2416	2576	AppLaunch.exe	30
PID 2576 wrote to memory of 2416	2576	AppLaunch.exe	30
PID 2576 wrote to memory of 2416	2576	AppLaunch.exe	30
PID 2576 wrote to memory of 2416	2576	AppLaunch.exe	30
PID 2576 wrote to memory of 2416	2576	AppLaunch.exe	30
PID 2576 wrote to memory of 2416	2576	AppLaunch.exe	30
PID 2576 wrote to memory of 2416	2576	AppLaunch.exe	30

memory/2576-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2576-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2576-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2576-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2576-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2576-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2576-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2576-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2576-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2576-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download