381916d6fb7edc9c8173fe16c87eed4c133c5ee9eaaa721f3d69eb3db044c06f

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19/09/2023, 20:29

Target

file.exe
Size

1.1MB
MD5

20b96c0bbcd693d63c7ed10fb41de166
SHA1

af1481a6f6328879f64208090fa42f165bc58136
SHA256

381916d6fb7edc9c8173fe16c87eed4c133c5ee9eaaa721f3d69eb3db044c06f
SHA512

2b45b889b784313a110832eef1315d38a14a8822b5f8192607fc247582ae158ebc4ad1c29a7193f78400aba7b9aa057ab3273b9e9a22ffcfe766080f41d4948b
SSDEEP

12288:vls86N2dA1IY9i4ytPrJx5ZVfV5TjzBTVyh43IubL5SnhwoUOfKUJACpA08crPoJ:Ns8Y2dA1h9i4ytvV/3d+6xDCT9rjA/

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3028 set thread context of 3068	3028	file.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2664	3028	WerFault.exe	27
2900	3068	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 3068	3028	file.exe	29
PID 3028 wrote to memory of 3068	3028	file.exe	29
PID 3028 wrote to memory of 3068	3028	file.exe	29
PID 3028 wrote to memory of 3068	3028	file.exe	29
PID 3028 wrote to memory of 3068	3028	file.exe	29
PID 3028 wrote to memory of 3068	3028	file.exe	29
PID 3028 wrote to memory of 3068	3028	file.exe	29
PID 3028 wrote to memory of 3068	3028	file.exe	29
PID 3028 wrote to memory of 3068	3028	file.exe	29
PID 3028 wrote to memory of 3068	3028	file.exe	29
PID 3028 wrote to memory of 3068	3028	file.exe	29
PID 3028 wrote to memory of 3068	3028	file.exe	29
PID 3028 wrote to memory of 3068	3028	file.exe	29
PID 3028 wrote to memory of 3068	3028	file.exe	29
PID 3028 wrote to memory of 2664	3028	file.exe	30
PID 3028 wrote to memory of 2664	3028	file.exe	30
PID 3028 wrote to memory of 2664	3028	file.exe	30
PID 3028 wrote to memory of 2664	3028	file.exe	30
PID 3068 wrote to memory of 2900	3068	AppLaunch.exe	31
PID 3068 wrote to memory of 2900	3068	AppLaunch.exe	31
PID 3068 wrote to memory of 2900	3068	AppLaunch.exe	31
PID 3068 wrote to memory of 2900	3068	AppLaunch.exe	31
PID 3068 wrote to memory of 2900	3068	AppLaunch.exe	31
PID 3068 wrote to memory of 2900	3068	AppLaunch.exe	31
PID 3068 wrote to memory of 2900	3068	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 196
    3⤵
    - Program crash
    PID:2900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 92
  2⤵
  - Program crash
  PID:2664

memory/3068-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3068-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3068-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3068-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3068-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3068-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3068-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3068-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3068-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3068-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download