c4e0cb607d432343219b41d78c2ec5dd75cd61337e01004ddbd2a25678afd2f2

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
21/09/2023, 18:00

Target

file.exe
Size

700KB
MD5

a940041c46398589b82411421e1da99c
SHA1

dcda71537ac11519b263f6afc002f0714175a95e
SHA256

c4e0cb607d432343219b41d78c2ec5dd75cd61337e01004ddbd2a25678afd2f2
SHA512

072e369b2798aea4fbdb9490f78bf5560f475a33c6b46b146dd54062ec8af26e0d9f280813af29ae368e16adec60a8c7d4126d9c5bdca47d9a42ffd3abd93de0
SSDEEP

6144:f6vGALXgBEIy8wluzNcq/PVucQpbupc5YLu2+OYAO57ehy8wCmhM7vJQ8xWyvfr:SHXgFysVucQpb03UMwc1Nx/r

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2884 set thread context of 2164	2884	file.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2080	2884	WerFault.exe	27
2220	2164	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2164	2884	file.exe	29
PID 2884 wrote to memory of 2164	2884	file.exe	29
PID 2884 wrote to memory of 2164	2884	file.exe	29
PID 2884 wrote to memory of 2164	2884	file.exe	29
PID 2884 wrote to memory of 2164	2884	file.exe	29
PID 2884 wrote to memory of 2164	2884	file.exe	29
PID 2884 wrote to memory of 2164	2884	file.exe	29
PID 2884 wrote to memory of 2164	2884	file.exe	29
PID 2884 wrote to memory of 2164	2884	file.exe	29
PID 2884 wrote to memory of 2164	2884	file.exe	29
PID 2884 wrote to memory of 2164	2884	file.exe	29
PID 2884 wrote to memory of 2164	2884	file.exe	29
PID 2884 wrote to memory of 2164	2884	file.exe	29
PID 2884 wrote to memory of 2164	2884	file.exe	29
PID 2884 wrote to memory of 2080	2884	file.exe	30
PID 2884 wrote to memory of 2080	2884	file.exe	30
PID 2884 wrote to memory of 2080	2884	file.exe	30
PID 2884 wrote to memory of 2080	2884	file.exe	30
PID 2164 wrote to memory of 2220	2164	AppLaunch.exe	31
PID 2164 wrote to memory of 2220	2164	AppLaunch.exe	31
PID 2164 wrote to memory of 2220	2164	AppLaunch.exe	31
PID 2164 wrote to memory of 2220	2164	AppLaunch.exe	31
PID 2164 wrote to memory of 2220	2164	AppLaunch.exe	31
PID 2164 wrote to memory of 2220	2164	AppLaunch.exe	31
PID 2164 wrote to memory of 2220	2164	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 196
    3⤵
    - Program crash
    PID:2220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 92
  2⤵
  - Program crash
  PID:2080

memory/2164-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2164-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2164-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2164-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2164-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2164-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2164-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2164-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2164-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2164-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download