84be47f95a3422f33b93fa9549b916885ff113258f21c13aa2ffbab7aea5cfd4

Analysis

max time kernel
122s
max time network
142s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
18/11/2023, 02:57

Target

CupFixer.exe
Size

8.7MB
MD5

1f2ef76d1e445de858ded5a0b2834630
SHA1

03d0bdfbfc8069fc057e5c70a2a9d0e8a37c5576
SHA256

84be47f95a3422f33b93fa9549b916885ff113258f21c13aa2ffbab7aea5cfd4
SHA512

ffc92eadbb7469c86c6087bdb41a5767bd138ad76123b03acecf19e2a95cc4456e4ef39719dd2df45b365e1eac1c252b7a8254fb2db691674a26c68a57b58eda
SSDEEP

196608:XUJlpPbv3H6bESgmATk/Pesw3ixXnhoy42CHo9g8BmOxxZrYPBNFYIX:XUJPebpgmATkcIXKH2oo9g8IOxxW3e

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2988	CupFixer.exe
2988	CupFixer.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2632	2988	CupFixer.exe	29
PID 2988 wrote to memory of 2632	2988	CupFixer.exe	29
PID 2988 wrote to memory of 2632	2988	CupFixer.exe	29
PID 2988 wrote to memory of 2708	2988	CupFixer.exe	30
PID 2988 wrote to memory of 2708	2988	CupFixer.exe	30
PID 2988 wrote to memory of 2708	2988	CupFixer.exe	30

C:\Users\Admin\AppData\Local\Temp\CupFixer.exe
"C:\Users\Admin\AppData\Local\Temp\CupFixer.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2632
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2988 -s 392
  2⤵
  PID:2708

memory/2988-0-0x000000013FEE0000-0x0000000142CBD000-memory.dmp

Filesize
45.9MB

Download
memory/2988-1-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2988-3-0x000000013FEE0000-0x0000000142CBD000-memory.dmp

Filesize
45.9MB

Download
memory/2988-4-0x000000013FEE0000-0x0000000142CBD000-memory.dmp

Filesize
45.9MB

Download
memory/2988-5-0x000000013FEE0000-0x0000000142CBD000-memory.dmp

Filesize
45.9MB

Download
memory/2988-6-0x000000013FEE0000-0x0000000142CBD000-memory.dmp

Filesize
45.9MB

Download
memory/2988-7-0x00000000771F0000-0x0000000077399000-memory.dmp

Filesize
1.7MB

Download
memory/2988-8-0x00000000771F0000-0x0000000077399000-memory.dmp

Filesize
1.7MB

Download
memory/2988-9-0x0000000001E80000-0x0000000001E90000-memory.dmp

Filesize
64KB

Download
memory/2988-10-0x00000000773A0000-0x00000000773B0000-memory.dmp

Filesize
64KB

Download
memory/2988-11-0x000000013FEE0000-0x0000000142CBD000-memory.dmp

Filesize
45.9MB

Download
memory/2988-12-0x000000013FEE0000-0x0000000142CBD000-memory.dmp

Filesize
45.9MB

Download
memory/2988-13-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2988-14-0x00000000771F0000-0x0000000077399000-memory.dmp

Filesize
1.7MB

Download