d400ae8368680805e1172303d27358f44dc6428ff6a304622bd43f79956fb0d4

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
30/09/2023, 13:38

Target

file.exe
Size

276KB
MD5

a4f2a650766595ed4b745f5abefddc29
SHA1

82a6587a3b37b06fb325e82c7f35c79314de629a
SHA256

d400ae8368680805e1172303d27358f44dc6428ff6a304622bd43f79956fb0d4
SHA512

2daadae5186ddad03c45ac72d484f9bcf509a0bd7e1dfd07028b7da8865dca78934a5d8a5beb3505e0d13c1bb142bb9d1feb5d7a51a3b389b8777428276b34fc
SSDEEP

6144:WhBnKajWpVP06xohFl23ha6sSHNEzZJ0wy5leXwbK7rj:WfKajWmjlaszZJ0wy5leXwbyj

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2828 set thread context of 1776	2828	file.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2436	2828	WerFault.exe	27
2616	1776	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 1776	2828	file.exe	29
PID 2828 wrote to memory of 1776	2828	file.exe	29
PID 2828 wrote to memory of 1776	2828	file.exe	29
PID 2828 wrote to memory of 1776	2828	file.exe	29
PID 2828 wrote to memory of 1776	2828	file.exe	29
PID 2828 wrote to memory of 1776	2828	file.exe	29
PID 2828 wrote to memory of 1776	2828	file.exe	29
PID 2828 wrote to memory of 1776	2828	file.exe	29
PID 2828 wrote to memory of 1776	2828	file.exe	29
PID 2828 wrote to memory of 1776	2828	file.exe	29
PID 2828 wrote to memory of 1776	2828	file.exe	29
PID 2828 wrote to memory of 1776	2828	file.exe	29
PID 2828 wrote to memory of 1776	2828	file.exe	29
PID 2828 wrote to memory of 1776	2828	file.exe	29
PID 2828 wrote to memory of 2436	2828	file.exe	30
PID 2828 wrote to memory of 2436	2828	file.exe	30
PID 2828 wrote to memory of 2436	2828	file.exe	30
PID 2828 wrote to memory of 2436	2828	file.exe	30
PID 1776 wrote to memory of 2616	1776	AppLaunch.exe	31
PID 1776 wrote to memory of 2616	1776	AppLaunch.exe	31
PID 1776 wrote to memory of 2616	1776	AppLaunch.exe	31
PID 1776 wrote to memory of 2616	1776	AppLaunch.exe	31
PID 1776 wrote to memory of 2616	1776	AppLaunch.exe	31
PID 1776 wrote to memory of 2616	1776	AppLaunch.exe	31
PID 1776 wrote to memory of 2616	1776	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 196
    3⤵
    - Program crash
    PID:2616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 68
  2⤵
  - Program crash
  PID:2436

memory/1776-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1776-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1776-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1776-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1776-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1776-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1776-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1776-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1776-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1776-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download