dc608d826299cfee0866c40e64c996ac544c96b064c2e359c82429bdf3ff7309

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 01:03

Target

1YZ83RQ4.exe
Size

423KB
MD5

41eda244db595adbe8ce28edee87429e
SHA1

c45a1515333cf5f5219ff94bc342cec64c8682ac
SHA256

dc608d826299cfee0866c40e64c996ac544c96b064c2e359c82429bdf3ff7309
SHA512

fc9cd50ef43946944c4867dd6b8d9a7f210a17b7a30c7c5083fb74968099327145aa143007f761169eae388c19f2116e6bda0495f10656549a84c5d1667e4633
SSDEEP

6144:oDofpu01XFBvaKAwQtdsJlfpoCJAO081Wziu4aLpxYecqS3ZjajqQrlS:oDoxf1XFBC2JQCJP3u7p6v3ZuJrlS

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2688 set thread context of 3016	2688	1YZ83RQ4.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2708	2688	WerFault.exe	17
2724	3016	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 3016	2688	1YZ83RQ4.exe	28
PID 2688 wrote to memory of 3016	2688	1YZ83RQ4.exe	28
PID 2688 wrote to memory of 3016	2688	1YZ83RQ4.exe	28
PID 2688 wrote to memory of 3016	2688	1YZ83RQ4.exe	28
PID 2688 wrote to memory of 3016	2688	1YZ83RQ4.exe	28
PID 2688 wrote to memory of 3016	2688	1YZ83RQ4.exe	28
PID 2688 wrote to memory of 3016	2688	1YZ83RQ4.exe	28
PID 2688 wrote to memory of 3016	2688	1YZ83RQ4.exe	28
PID 2688 wrote to memory of 3016	2688	1YZ83RQ4.exe	28
PID 2688 wrote to memory of 3016	2688	1YZ83RQ4.exe	28
PID 2688 wrote to memory of 3016	2688	1YZ83RQ4.exe	28
PID 2688 wrote to memory of 3016	2688	1YZ83RQ4.exe	28
PID 2688 wrote to memory of 3016	2688	1YZ83RQ4.exe	28
PID 2688 wrote to memory of 3016	2688	1YZ83RQ4.exe	28
PID 2688 wrote to memory of 2708	2688	1YZ83RQ4.exe	29
PID 2688 wrote to memory of 2708	2688	1YZ83RQ4.exe	29
PID 2688 wrote to memory of 2708	2688	1YZ83RQ4.exe	29
PID 2688 wrote to memory of 2708	2688	1YZ83RQ4.exe	29
PID 3016 wrote to memory of 2724	3016	AppLaunch.exe	30
PID 3016 wrote to memory of 2724	3016	AppLaunch.exe	30
PID 3016 wrote to memory of 2724	3016	AppLaunch.exe	30
PID 3016 wrote to memory of 2724	3016	AppLaunch.exe	30
PID 3016 wrote to memory of 2724	3016	AppLaunch.exe	30
PID 3016 wrote to memory of 2724	3016	AppLaunch.exe	30
PID 3016 wrote to memory of 2724	3016	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\1YZ83RQ4.exe
"C:\Users\Admin\AppData\Local\Temp\1YZ83RQ4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 196
    3⤵
    - Program crash
    PID:2724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 136
  2⤵
  - Program crash
  PID:2708

memory/3016-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3016-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3016-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3016-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3016-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3016-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3016-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3016-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3016-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3016-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download