86df8ba1cd3d406b735a97cf39f476880b26f704910745d4e1fe4e173846379b

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19-09-2023 06:53

Target

k9923261.exe
Size

371KB
MD5

fc52cd375f3f015cfb2aff8721133e8d
SHA1

357b322d6609f50e0b29a7eb51e755d25360ff24
SHA256

86df8ba1cd3d406b735a97cf39f476880b26f704910745d4e1fe4e173846379b
SHA512

1a150f51105d0a1731e30b35dfb0eb6034a8a9cc7afff06a02b9209c2ca6b3691cf518cf278a453e25e39f75ba604488f6227d051071ca6edc087cb44a7ceb8b
SSDEEP

6144:hbvJm09zORs+z/TMify9DAObgQfyIBjtUAo0BuhiRWbKC8z+YGkh8/:h7w09CK5N6CBjz+kl8/

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

k9923261.exe

description pid process target process

PID 2936 set thread context of 2804 2936 k9923261.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1280 2804 WerFault.exe AppLaunch.exe

description	pid	process	target process
PID 2936 set thread context of 2804	2936	k9923261.exe	AppLaunch.exe

pid	pid_target	process	target process
1280	2804	WerFault.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

k9923261.exeAppLaunch.exe

description	pid	process	target process
PID 2936 wrote to memory of 2804	2936	k9923261.exe	AppLaunch.exe
PID 2936 wrote to memory of 2804	2936	k9923261.exe	AppLaunch.exe
PID 2936 wrote to memory of 2804	2936	k9923261.exe	AppLaunch.exe
PID 2936 wrote to memory of 2804	2936	k9923261.exe	AppLaunch.exe
PID 2936 wrote to memory of 2804	2936	k9923261.exe	AppLaunch.exe
PID 2936 wrote to memory of 2804	2936	k9923261.exe	AppLaunch.exe
PID 2936 wrote to memory of 2804	2936	k9923261.exe	AppLaunch.exe
PID 2936 wrote to memory of 2804	2936	k9923261.exe	AppLaunch.exe
PID 2936 wrote to memory of 2804	2936	k9923261.exe	AppLaunch.exe
PID 2936 wrote to memory of 2804	2936	k9923261.exe	AppLaunch.exe
PID 2936 wrote to memory of 2804	2936	k9923261.exe	AppLaunch.exe
PID 2936 wrote to memory of 2804	2936	k9923261.exe	AppLaunch.exe
PID 2936 wrote to memory of 2804	2936	k9923261.exe	AppLaunch.exe
PID 2936 wrote to memory of 2804	2936	k9923261.exe	AppLaunch.exe
PID 2804 wrote to memory of 1280	2804	AppLaunch.exe	WerFault.exe
PID 2804 wrote to memory of 1280	2804	AppLaunch.exe	WerFault.exe
PID 2804 wrote to memory of 1280	2804	AppLaunch.exe	WerFault.exe
PID 2804 wrote to memory of 1280	2804	AppLaunch.exe	WerFault.exe
PID 2804 wrote to memory of 1280	2804	AppLaunch.exe	WerFault.exe
PID 2804 wrote to memory of 1280	2804	AppLaunch.exe	WerFault.exe
PID 2804 wrote to memory of 1280	2804	AppLaunch.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\k9923261.exe
"C:\Users\Admin\AppData\Local\Temp\k9923261.exe"
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2936

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
- Suspicious use of WriteProcessMemory
PID:2804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 196
- Program crash
PID:1280

memory/2804-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2804-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2804-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2804-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2804-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2804-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2804-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2804-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2804-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2804-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download