3c17e31ed7c3dfa69dcf960a5521260ddcfe6e86552d8d7f1a061daf05328a90

Analysis

max time kernel
120s
max time network
150s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 11:26

Target

file.exe
Size

1.1MB
MD5

fcc0c9eb453fb43290bc0be34c2c2d25
SHA1

5fbbcd39d719525b7ab235ba36a3191b10652408
SHA256

3c17e31ed7c3dfa69dcf960a5521260ddcfe6e86552d8d7f1a061daf05328a90
SHA512

c56f79d05f14fcefcad4ee1339bff90fdb938730ca56072c53e5db8c1de188858fafd2bb270db0c39c796472853f256012c92ddd7f7c823c1ff9cffe9e207398
SSDEEP

12288:9NswnN2dA1IY9i4ytPDxZZZVf95Tjz8L2aB4vIubLk48Fyf4ruqMfL8lhrG82fHY:bswN2dA1h9i4ytXVX3dAfMQlNG82fcAW

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2012 set thread context of 2080	2012	file.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2764	2012	WerFault.exe	17
2784	2080	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2080	2012	file.exe	29
PID 2012 wrote to memory of 2080	2012	file.exe	29
PID 2012 wrote to memory of 2080	2012	file.exe	29
PID 2012 wrote to memory of 2080	2012	file.exe	29
PID 2012 wrote to memory of 2080	2012	file.exe	29
PID 2012 wrote to memory of 2080	2012	file.exe	29
PID 2012 wrote to memory of 2080	2012	file.exe	29
PID 2012 wrote to memory of 2080	2012	file.exe	29
PID 2012 wrote to memory of 2080	2012	file.exe	29
PID 2012 wrote to memory of 2080	2012	file.exe	29
PID 2012 wrote to memory of 2080	2012	file.exe	29
PID 2012 wrote to memory of 2080	2012	file.exe	29
PID 2012 wrote to memory of 2080	2012	file.exe	29
PID 2012 wrote to memory of 2080	2012	file.exe	29
PID 2012 wrote to memory of 2764	2012	file.exe	30
PID 2012 wrote to memory of 2764	2012	file.exe	30
PID 2012 wrote to memory of 2764	2012	file.exe	30
PID 2012 wrote to memory of 2764	2012	file.exe	30
PID 2080 wrote to memory of 2784	2080	AppLaunch.exe	31
PID 2080 wrote to memory of 2784	2080	AppLaunch.exe	31
PID 2080 wrote to memory of 2784	2080	AppLaunch.exe	31
PID 2080 wrote to memory of 2784	2080	AppLaunch.exe	31
PID 2080 wrote to memory of 2784	2080	AppLaunch.exe	31
PID 2080 wrote to memory of 2784	2080	AppLaunch.exe	31
PID 2080 wrote to memory of 2784	2080	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 196
    3⤵
    - Program crash
    PID:2784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 92
  2⤵
  - Program crash
  PID:2764

memory/2080-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2080-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2080-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2080-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2080-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2080-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2080-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2080-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2080-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2080-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download