865ae1c546b12381f15add47b63c8e4ee09ba8f3a6748ae7ddb255f16f78c972

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
30-09-2023 14:25

Target

file.exe
Size

276KB
MD5

922b7cc52f8f84fc5b73a749b845bce4
SHA1

149b0ba27092abb9992d2576b94043bc9aa2f3f2
SHA256

865ae1c546b12381f15add47b63c8e4ee09ba8f3a6748ae7ddb255f16f78c972
SHA512

ddd9ef044467737b013b0665df488c4a90954e515a5cb507acf3f06de33f1ba3ffd8a727cec4e3e65af195605fed87043c7de3a06f9d65bd1d46f685df7b49b2
SSDEEP

6144:WhtYk2jWRsLz6zpclVdU5SnJFYAqMQVOkh5UChk6qBBfjy1Oj:Wsk2jWVcDZqpObCGVBfjycj

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1784 set thread context of 3052	1784	file.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2692	1784	WerFault.exe	16
2808	3052	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 3052	1784	file.exe	29
PID 1784 wrote to memory of 3052	1784	file.exe	29
PID 1784 wrote to memory of 3052	1784	file.exe	29
PID 1784 wrote to memory of 3052	1784	file.exe	29
PID 1784 wrote to memory of 3052	1784	file.exe	29
PID 1784 wrote to memory of 3052	1784	file.exe	29
PID 1784 wrote to memory of 3052	1784	file.exe	29
PID 1784 wrote to memory of 3052	1784	file.exe	29
PID 1784 wrote to memory of 3052	1784	file.exe	29
PID 1784 wrote to memory of 3052	1784	file.exe	29
PID 1784 wrote to memory of 3052	1784	file.exe	29
PID 1784 wrote to memory of 3052	1784	file.exe	29
PID 1784 wrote to memory of 3052	1784	file.exe	29
PID 1784 wrote to memory of 3052	1784	file.exe	29
PID 1784 wrote to memory of 2692	1784	file.exe	30
PID 1784 wrote to memory of 2692	1784	file.exe	30
PID 1784 wrote to memory of 2692	1784	file.exe	30
PID 1784 wrote to memory of 2692	1784	file.exe	30
PID 3052 wrote to memory of 2808	3052	AppLaunch.exe	31
PID 3052 wrote to memory of 2808	3052	AppLaunch.exe	31
PID 3052 wrote to memory of 2808	3052	AppLaunch.exe	31
PID 3052 wrote to memory of 2808	3052	AppLaunch.exe	31
PID 3052 wrote to memory of 2808	3052	AppLaunch.exe	31
PID 3052 wrote to memory of 2808	3052	AppLaunch.exe	31
PID 3052 wrote to memory of 2808	3052	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 196
    3⤵
    - Program crash
    PID:2808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 68
  2⤵
  - Program crash
  PID:2692

memory/3052-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3052-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3052-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3052-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3052-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3052-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3052-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3052-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3052-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3052-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download