4ff55a219ec1d040dae321e14c0ddb27f02ac7933d795c7431c7bfb05271d9aa

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16/10/2023, 13:43

Target

file.exe
Size

328KB
MD5

a1174109f02b328ba1f96aa7d7ea3e9a
SHA1

3a6521a3e38253003c7891299ef0e1777a72e34d
SHA256

4ff55a219ec1d040dae321e14c0ddb27f02ac7933d795c7431c7bfb05271d9aa
SHA512

707a237d12d58de9302c0e789620831e9c33cdb75764349fa3ddd9090bd80e6cf90ee43b1e4089f206ad501457c502a6445c31d0dac6bbfddd607b10fd387e11
SSDEEP

6144:8wZrUxBda9xwyHlCv3F9jn54qQpOyilwFRjxk9ei9cfOZyEJuVi6rkwdDfW6:7ZraBdKweC/j5dKeei2f0zuprkwdDfW6

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2468 set thread context of 2400	2468	file.exe	27

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2584	2400	WerFault.exe	27

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2400	2468	file.exe	27
PID 2468 wrote to memory of 2400	2468	file.exe	27
PID 2468 wrote to memory of 2400	2468	file.exe	27
PID 2468 wrote to memory of 2400	2468	file.exe	27
PID 2468 wrote to memory of 2400	2468	file.exe	27
PID 2468 wrote to memory of 2400	2468	file.exe	27
PID 2468 wrote to memory of 2400	2468	file.exe	27
PID 2468 wrote to memory of 2400	2468	file.exe	27
PID 2468 wrote to memory of 2400	2468	file.exe	27
PID 2468 wrote to memory of 2400	2468	file.exe	27
PID 2468 wrote to memory of 2400	2468	file.exe	27
PID 2468 wrote to memory of 2400	2468	file.exe	27
PID 2468 wrote to memory of 2400	2468	file.exe	27
PID 2468 wrote to memory of 2400	2468	file.exe	27
PID 2400 wrote to memory of 2584	2400	AppLaunch.exe	28
PID 2400 wrote to memory of 2584	2400	AppLaunch.exe	28
PID 2400 wrote to memory of 2584	2400	AppLaunch.exe	28
PID 2400 wrote to memory of 2584	2400	AppLaunch.exe	28
PID 2400 wrote to memory of 2584	2400	AppLaunch.exe	28
PID 2400 wrote to memory of 2584	2400	AppLaunch.exe	28
PID 2400 wrote to memory of 2584	2400	AppLaunch.exe	28

memory/2400-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2400-1-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2400-2-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2400-3-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2400-5-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2400-7-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2400-9-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2400-10-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2400-12-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2400-14-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download