7cf27f59335e71f71f652ea7692ef942272868b524447b63c392d3c73c68d902

Analysis

max time kernel
123s
max time network
132s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
12/10/2023, 22:16

Target

7cf27f59335e71f71f652ea7692ef942272868b524447b63c392d3c73c68d902.exe
Size

1.1MB
MD5

378862aa20999b67a5bb9689c9c44a50
SHA1

68524fda0ec1cf23c351d9b7a921257bf85cb5df
SHA256

7cf27f59335e71f71f652ea7692ef942272868b524447b63c392d3c73c68d902
SHA512

243fc36e28f523e95168b585ab08dc767f276a680e196e0a43957fe2a56cf966e2920b5e09b5fda6d064aad3d32dc951cebf3dd0a3ff466e1e5fe230e5b2ae59
SSDEEP

12288:Ktqj4/qM7PFNwvExgVExchiZXJIOY1+gXcpuHot8JPb7pTlTJcfcm0:ky4/qM7PFNwcRd7tY1WWJJTQfc

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3928 set thread context of 5112	3928	7cf27f59335e71f71f652ea7692ef942272868b524447b63c392d3c73c68d902.exe	72

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4436	3928	WerFault.exe	69

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 4124	3928	7cf27f59335e71f71f652ea7692ef942272868b524447b63c392d3c73c68d902.exe	71
PID 3928 wrote to memory of 4124	3928	7cf27f59335e71f71f652ea7692ef942272868b524447b63c392d3c73c68d902.exe	71
PID 3928 wrote to memory of 4124	3928	7cf27f59335e71f71f652ea7692ef942272868b524447b63c392d3c73c68d902.exe	71
PID 3928 wrote to memory of 5112	3928	7cf27f59335e71f71f652ea7692ef942272868b524447b63c392d3c73c68d902.exe	72
PID 3928 wrote to memory of 5112	3928	7cf27f59335e71f71f652ea7692ef942272868b524447b63c392d3c73c68d902.exe	72
PID 3928 wrote to memory of 5112	3928	7cf27f59335e71f71f652ea7692ef942272868b524447b63c392d3c73c68d902.exe	72
PID 3928 wrote to memory of 5112	3928	7cf27f59335e71f71f652ea7692ef942272868b524447b63c392d3c73c68d902.exe	72
PID 3928 wrote to memory of 5112	3928	7cf27f59335e71f71f652ea7692ef942272868b524447b63c392d3c73c68d902.exe	72
PID 3928 wrote to memory of 5112	3928	7cf27f59335e71f71f652ea7692ef942272868b524447b63c392d3c73c68d902.exe	72
PID 3928 wrote to memory of 5112	3928	7cf27f59335e71f71f652ea7692ef942272868b524447b63c392d3c73c68d902.exe	72
PID 3928 wrote to memory of 5112	3928	7cf27f59335e71f71f652ea7692ef942272868b524447b63c392d3c73c68d902.exe	72
PID 3928 wrote to memory of 5112	3928	7cf27f59335e71f71f652ea7692ef942272868b524447b63c392d3c73c68d902.exe	72
PID 3928 wrote to memory of 5112	3928	7cf27f59335e71f71f652ea7692ef942272868b524447b63c392d3c73c68d902.exe	72

C:\Users\Admin\AppData\Local\Temp\7cf27f59335e71f71f652ea7692ef942272868b524447b63c392d3c73c68d902.exe
"C:\Users\Admin\AppData\Local\Temp\7cf27f59335e71f71f652ea7692ef942272868b524447b63c392d3c73c68d902.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4124
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:5112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 232
  2⤵
  - Program crash
  PID:4436

memory/5112-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5112-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5112-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5112-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5112-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download