a62467a00b7447610aa2b6d2f0b1e82c56086d9ee0411a96b4d49889ae03b2ac

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
19/11/2023, 23:50

Target

057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe
Size

646KB
MD5

d569c4642597d5b883b3ae598bcc19b3
SHA1

7b8fa0006d9a7dc803eb1dd5c2ab2b4314942001
SHA256

057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910
SHA512

8dfb4d6280de31e2183a19ed790626485004d66a2b85d2dc3312b06a05cd47fe82add4e64d417709a38ea28ee7c3f0275af90fd1534857b5be643ea4d709ebe6
SSDEEP

12288:3uP4KRi4cu659UrnsLoaEYkTOKKvnZzxoYYxj9eKjRKvYqg:iJRik65iwuYZ1oYgi1

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1180 set thread context of 2856	1180	057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2076	2856	WerFault.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2856	057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 2856	1180	057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe	30
PID 1180 wrote to memory of 2856	1180	057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe	30
PID 1180 wrote to memory of 2856	1180	057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe	30
PID 1180 wrote to memory of 2856	1180	057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe	30
PID 1180 wrote to memory of 2856	1180	057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe	30
PID 1180 wrote to memory of 2856	1180	057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe	30
PID 1180 wrote to memory of 2856	1180	057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe	30
PID 2856 wrote to memory of 2076	2856	057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe	31
PID 2856 wrote to memory of 2076	2856	057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe	31
PID 2856 wrote to memory of 2076	2856	057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe	31
PID 2856 wrote to memory of 2076	2856	057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe	31

memory/1180-0-0x0000000074D80000-0x000000007546E000-memory.dmp

Filesize
6.9MB

Download
memory/1180-1-0x0000000000A80000-0x0000000000B28000-memory.dmp

Filesize
672KB

Download
memory/1180-2-0x0000000004E90000-0x0000000004ED0000-memory.dmp

Filesize
256KB

Download
memory/1180-3-0x0000000000310000-0x0000000000326000-memory.dmp

Filesize
88KB

Download
memory/1180-4-0x0000000074D80000-0x000000007546E000-memory.dmp

Filesize
6.9MB

Download
memory/1180-5-0x0000000000350000-0x000000000035A000-memory.dmp

Filesize
40KB

Download
memory/1180-6-0x0000000005770000-0x00000000057EC000-memory.dmp

Filesize
496KB

Download
memory/1180-12-0x0000000074D80000-0x000000007546E000-memory.dmp

Filesize
6.9MB

Download
memory/2856-11-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2856-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2856-8-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2856-7-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2856-13-0x0000000000B30000-0x0000000000E33000-memory.dmp

Filesize
3.0MB

Download
memory/2856-14-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download