5ba771db299ff03c5eeeec6ca6105333267a44fdade1d0c38723c333aaabced3

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19/09/2023, 18:44

Target

file.exe
Size

1.1MB
MD5

13e85cd876f17a96755b8deadf1a637c
SHA1

ca5fa5fa232439cb737235bedf341399abdd5080
SHA256

5ba771db299ff03c5eeeec6ca6105333267a44fdade1d0c38723c333aaabced3
SHA512

8f717908ed38c76995ed7c17faedb257195539736b2dafe27fb5b555dd47b18942a02707dcc476a108f1a31ffb7326f37f435b05ad48ca0334919aa73b44f4e9
SSDEEP

12288:Y1ss6N2dA1IY9i4ytPrZhKZVfk5Tjzyj+ih4gIubL4ARezZbTqrOkJZ5pydLCAS:essY2dA1h9i4ytoVM3cUdbTqCUpVAS

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 628 set thread context of 2068	628	file.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2340	628	WerFault.exe	27
1632	2068	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 2068	628	file.exe	29
PID 628 wrote to memory of 2068	628	file.exe	29
PID 628 wrote to memory of 2068	628	file.exe	29
PID 628 wrote to memory of 2068	628	file.exe	29
PID 628 wrote to memory of 2068	628	file.exe	29
PID 628 wrote to memory of 2068	628	file.exe	29
PID 628 wrote to memory of 2068	628	file.exe	29
PID 628 wrote to memory of 2068	628	file.exe	29
PID 628 wrote to memory of 2068	628	file.exe	29
PID 628 wrote to memory of 2068	628	file.exe	29
PID 628 wrote to memory of 2068	628	file.exe	29
PID 628 wrote to memory of 2068	628	file.exe	29
PID 628 wrote to memory of 2068	628	file.exe	29
PID 628 wrote to memory of 2068	628	file.exe	29
PID 628 wrote to memory of 2340	628	file.exe	30
PID 628 wrote to memory of 2340	628	file.exe	30
PID 628 wrote to memory of 2340	628	file.exe	30
PID 628 wrote to memory of 2340	628	file.exe	30
PID 2068 wrote to memory of 1632	2068	AppLaunch.exe	31
PID 2068 wrote to memory of 1632	2068	AppLaunch.exe	31
PID 2068 wrote to memory of 1632	2068	AppLaunch.exe	31
PID 2068 wrote to memory of 1632	2068	AppLaunch.exe	31
PID 2068 wrote to memory of 1632	2068	AppLaunch.exe	31
PID 2068 wrote to memory of 1632	2068	AppLaunch.exe	31
PID 2068 wrote to memory of 1632	2068	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 196
    3⤵
    - Program crash
    PID:1632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 92
  2⤵
  - Program crash
  PID:2340

memory/2068-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2068-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2068-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2068-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2068-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2068-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2068-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2068-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2068-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2068-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download