fe265258046223bb8f78e71ac0ed7a498650229971ec3c59089b930893c21c19

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
21-09-2023 21:25

Target

file.exe
Size

700KB
MD5

a775c3fc757901fe6595eb250b3a81bd
SHA1

8b6af92602004ad799346e671afacaa935fd622e
SHA256

fe265258046223bb8f78e71ac0ed7a498650229971ec3c59089b930893c21c19
SHA512

e367d079302a1df3f386367d09488dd35478f4ae803c5f74c4550b4504ad569087cccf19fc271b2e849c24022682cd9b076c7998805225b42af3cf390a2784f1
SSDEEP

6144:RSvGAafgBMniUwluzlcy/XVucQ5+AEum9Tb9d49HiRyy47mTQBs492kQuPfz:0Gfg2i8VucQ5Tm9Tb9m0RyyA9K49JQiz

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2108 set thread context of 2416	2108	file.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1336	2108	WerFault.exe	27
2932	2416	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2416	2108	file.exe	29
PID 2108 wrote to memory of 2416	2108	file.exe	29
PID 2108 wrote to memory of 2416	2108	file.exe	29
PID 2108 wrote to memory of 2416	2108	file.exe	29
PID 2108 wrote to memory of 2416	2108	file.exe	29
PID 2108 wrote to memory of 2416	2108	file.exe	29
PID 2108 wrote to memory of 2416	2108	file.exe	29
PID 2108 wrote to memory of 2416	2108	file.exe	29
PID 2108 wrote to memory of 2416	2108	file.exe	29
PID 2108 wrote to memory of 2416	2108	file.exe	29
PID 2108 wrote to memory of 2416	2108	file.exe	29
PID 2108 wrote to memory of 2416	2108	file.exe	29
PID 2108 wrote to memory of 2416	2108	file.exe	29
PID 2108 wrote to memory of 2416	2108	file.exe	29
PID 2108 wrote to memory of 1336	2108	file.exe	30
PID 2108 wrote to memory of 1336	2108	file.exe	30
PID 2108 wrote to memory of 1336	2108	file.exe	30
PID 2108 wrote to memory of 1336	2108	file.exe	30
PID 2416 wrote to memory of 2932	2416	AppLaunch.exe	31
PID 2416 wrote to memory of 2932	2416	AppLaunch.exe	31
PID 2416 wrote to memory of 2932	2416	AppLaunch.exe	31
PID 2416 wrote to memory of 2932	2416	AppLaunch.exe	31
PID 2416 wrote to memory of 2932	2416	AppLaunch.exe	31
PID 2416 wrote to memory of 2932	2416	AppLaunch.exe	31
PID 2416 wrote to memory of 2932	2416	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 196
    3⤵
    - Program crash
    PID:2932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 92
  2⤵
  - Program crash
  PID:1336

memory/2416-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2416-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2416-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2416-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2416-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2416-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2416-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2416-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2416-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2416-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download