e60c4c5bea96445219862ae85e388fcc287ab8a87726e4836db591222b419e73

Analysis

max time kernel
142s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27-12-2023 06:26

Target

a6f6242f4fde096ff32f39f979e3908a.exe
Size

184KB
MD5

a6f6242f4fde096ff32f39f979e3908a
SHA1

66c525eb15c769e15f05c05070526433bb0f40b6
SHA256

e60c4c5bea96445219862ae85e388fcc287ab8a87726e4836db591222b419e73
SHA512

88f66679bcc493c4e77c6863311d2ccb332c52d54da7142005f2cff071aa37cff0be5c274deb859a01ba518f70e7d25ccee95cdfb77179305667ec525467c3b4
SSDEEP

3072:WsOo1ZyHi/jxlGKcEpbmALjoc06+4vC8KsPVsxcBWj77i:dOSZyHi/jNCn74vCoPVsxSWHO

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

a6f6242f4fde096ff32f39f979e3908a.exe

description pid process target process

PID 2620 set thread context of 2376 2620 a6f6242f4fde096ff32f39f979e3908a.exe a6f6242f4fde096ff32f39f979e3908a.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2316 2376 WerFault.exe a6f6242f4fde096ff32f39f979e3908a.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

a6f6242f4fde096ff32f39f979e3908a.exe

pid process

2620 a6f6242f4fde096ff32f39f979e3908a.exe

description	pid	process	target process
PID 2620 set thread context of 2376	2620	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe

pid	pid_target	process	target process
2316	2376	WerFault.exe	a6f6242f4fde096ff32f39f979e3908a.exe

pid	process
2620	a6f6242f4fde096ff32f39f979e3908a.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

a6f6242f4fde096ff32f39f979e3908a.exea6f6242f4fde096ff32f39f979e3908a.exe

description	pid	process	target process
PID 2620 wrote to memory of 2376	2620	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 2620 wrote to memory of 2376	2620	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 2620 wrote to memory of 2376	2620	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 2620 wrote to memory of 2376	2620	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 2620 wrote to memory of 2376	2620	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 2620 wrote to memory of 2376	2620	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 2620 wrote to memory of 2376	2620	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 2620 wrote to memory of 2376	2620	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 2620 wrote to memory of 2376	2620	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 2620 wrote to memory of 2376	2620	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 2376 wrote to memory of 2316	2376	a6f6242f4fde096ff32f39f979e3908a.exe	WerFault.exe
PID 2376 wrote to memory of 2316	2376	a6f6242f4fde096ff32f39f979e3908a.exe	WerFault.exe
PID 2376 wrote to memory of 2316	2376	a6f6242f4fde096ff32f39f979e3908a.exe	WerFault.exe
PID 2376 wrote to memory of 2316	2376	a6f6242f4fde096ff32f39f979e3908a.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a6f6242f4fde096ff32f39f979e3908a.exe
"C:\Users\Admin\AppData\Local\Temp\a6f6242f4fde096ff32f39f979e3908a.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 88
3⤵
- Program crash
PID:2316

memory/2376-2-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2376-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2376-6-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2376-8-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download