efdb40c9a204350396083b0df45029afb731eb3e502a0ed5cf545fa3ca01c4f5

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 06:09

Target

file.exe
Size

700KB
MD5

13fcbf16f7125772f035e6a92ab7d87f
SHA1

567968a91a2dde28476a9795299e338f2097814b
SHA256

efdb40c9a204350396083b0df45029afb731eb3e502a0ed5cf545fa3ca01c4f5
SHA512

9601232f62e0b242685c3c39e786f06d2d29cbeeb4319ba2a0989182276eaf19f47c7bb6a852fe7538c0fc0175ae50c464ab745f92f71c41de4c6e6a72a2f458
SSDEEP

6144:kSvGAafgBMniUwluzlcy/XVucQ5oXMt89wyi9sgIff2LXdabBnvfz:1Gfg2i8VucQ5oXMSeJIff2Jabpz

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1824 set thread context of 2636	1824	file.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2672	1824	WerFault.exe	27
2984	2636	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 2636	1824	file.exe	29
PID 1824 wrote to memory of 2636	1824	file.exe	29
PID 1824 wrote to memory of 2636	1824	file.exe	29
PID 1824 wrote to memory of 2636	1824	file.exe	29
PID 1824 wrote to memory of 2636	1824	file.exe	29
PID 1824 wrote to memory of 2636	1824	file.exe	29
PID 1824 wrote to memory of 2636	1824	file.exe	29
PID 1824 wrote to memory of 2636	1824	file.exe	29
PID 1824 wrote to memory of 2636	1824	file.exe	29
PID 1824 wrote to memory of 2636	1824	file.exe	29
PID 1824 wrote to memory of 2636	1824	file.exe	29
PID 1824 wrote to memory of 2636	1824	file.exe	29
PID 1824 wrote to memory of 2636	1824	file.exe	29
PID 1824 wrote to memory of 2636	1824	file.exe	29
PID 1824 wrote to memory of 2672	1824	file.exe	30
PID 1824 wrote to memory of 2672	1824	file.exe	30
PID 1824 wrote to memory of 2672	1824	file.exe	30
PID 1824 wrote to memory of 2672	1824	file.exe	30
PID 2636 wrote to memory of 2984	2636	AppLaunch.exe	31
PID 2636 wrote to memory of 2984	2636	AppLaunch.exe	31
PID 2636 wrote to memory of 2984	2636	AppLaunch.exe	31
PID 2636 wrote to memory of 2984	2636	AppLaunch.exe	31
PID 2636 wrote to memory of 2984	2636	AppLaunch.exe	31
PID 2636 wrote to memory of 2984	2636	AppLaunch.exe	31
PID 2636 wrote to memory of 2984	2636	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 196
    3⤵
    - Program crash
    PID:2984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 92
  2⤵
  - Program crash
  PID:2672

memory/2636-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2636-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2636-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2636-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2636-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2636-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2636-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2636-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2636-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2636-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download