49aeabd3f7e08710ee1ef11b594243e52e6effb626c2bf5bda567cc43ef9a570

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19-09-2023 06:52

Target

k3020005.exe
Size

393KB
MD5

9c23875d800f4a3440360c85d420ad39
SHA1

c4a6c94c7c6b5d3d37d4612cec1ceb8ed3b19857
SHA256

49aeabd3f7e08710ee1ef11b594243e52e6effb626c2bf5bda567cc43ef9a570
SHA512

f761c5d81ea1c7494875377163f1fdce1cddc72b9af6051a8e358bdb15617890d4a66554f40b134b2b96f910f21feff59e182fb887d8dbe71f91e1afb9028ffe
SSDEEP

6144:xL4jE+2jicP5iOo2T8VrSd/sUAOfklq9PiwUj/yLCIrZ4pyqI49A7LordHLxB5Fq:xL4rqiG59outkCPiwUj21yKclWz1Sa

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

k3020005.exe

description pid process target process

PID 3004 set thread context of 2960 3004 k3020005.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

656 2960 WerFault.exe AppLaunch.exe

description	pid	process	target process
PID 3004 set thread context of 2960	3004	k3020005.exe	AppLaunch.exe

pid	pid_target	process	target process
656	2960	WerFault.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

k3020005.exeAppLaunch.exe

description	pid	process	target process
PID 3004 wrote to memory of 2960	3004	k3020005.exe	AppLaunch.exe
PID 3004 wrote to memory of 2960	3004	k3020005.exe	AppLaunch.exe
PID 3004 wrote to memory of 2960	3004	k3020005.exe	AppLaunch.exe
PID 3004 wrote to memory of 2960	3004	k3020005.exe	AppLaunch.exe
PID 3004 wrote to memory of 2960	3004	k3020005.exe	AppLaunch.exe
PID 3004 wrote to memory of 2960	3004	k3020005.exe	AppLaunch.exe
PID 3004 wrote to memory of 2960	3004	k3020005.exe	AppLaunch.exe
PID 3004 wrote to memory of 2960	3004	k3020005.exe	AppLaunch.exe
PID 3004 wrote to memory of 2960	3004	k3020005.exe	AppLaunch.exe
PID 3004 wrote to memory of 2960	3004	k3020005.exe	AppLaunch.exe
PID 3004 wrote to memory of 2960	3004	k3020005.exe	AppLaunch.exe
PID 3004 wrote to memory of 2960	3004	k3020005.exe	AppLaunch.exe
PID 3004 wrote to memory of 2960	3004	k3020005.exe	AppLaunch.exe
PID 3004 wrote to memory of 2960	3004	k3020005.exe	AppLaunch.exe
PID 2960 wrote to memory of 656	2960	AppLaunch.exe	WerFault.exe
PID 2960 wrote to memory of 656	2960	AppLaunch.exe	WerFault.exe
PID 2960 wrote to memory of 656	2960	AppLaunch.exe	WerFault.exe
PID 2960 wrote to memory of 656	2960	AppLaunch.exe	WerFault.exe
PID 2960 wrote to memory of 656	2960	AppLaunch.exe	WerFault.exe
PID 2960 wrote to memory of 656	2960	AppLaunch.exe	WerFault.exe
PID 2960 wrote to memory of 656	2960	AppLaunch.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\k3020005.exe
"C:\Users\Admin\AppData\Local\Temp\k3020005.exe"
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3004

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
- Suspicious use of WriteProcessMemory
PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 196
- Program crash
PID:656

memory/2960-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2960-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2960-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2960-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2960-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2960-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2960-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2960-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2960-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2960-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download