bd27945feb4cd4e615f1e8ead0f63529d33ae32a6e5a7006c1b09c2a6e4a6f6e

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 10:46

Target

3ca57720174052697f534d83cc0b853a.exe
Size

20KB
MD5

3ca57720174052697f534d83cc0b853a
SHA1

55cb2953c5a90b2208e86702670b3dfe79bc93b6
SHA256

bd27945feb4cd4e615f1e8ead0f63529d33ae32a6e5a7006c1b09c2a6e4a6f6e
SHA512

7b5bd82f54323099818737cc7bee8a4168763342dbbb5f555be0b4a6fde2ec65c46fa7d891ffe3853a2e26d8dccd9b9d493363a852355e3b3fd936a83fa13f5e
SSDEEP

384:SXnnVzPg18sECI2rA7iHmfYFyP6EDHeOsgVTnoZ5UlihsSnI2OTnPjCsBc/I6ZGD:SFapusmQF66YHiyUZ5DhRnI2WLCMwAD

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2108 set thread context of 2300	2108	3ca57720174052697f534d83cc0b853a.exe	17

Program crash 1 IoCs

pid	pid_target	Process
2084	2300	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2300	2108	3ca57720174052697f534d83cc0b853a.exe	17
PID 2108 wrote to memory of 2300	2108	3ca57720174052697f534d83cc0b853a.exe	17
PID 2108 wrote to memory of 2300	2108	3ca57720174052697f534d83cc0b853a.exe	17
PID 2108 wrote to memory of 2300	2108	3ca57720174052697f534d83cc0b853a.exe	17
PID 2108 wrote to memory of 2300	2108	3ca57720174052697f534d83cc0b853a.exe	17
PID 2108 wrote to memory of 2300	2108	3ca57720174052697f534d83cc0b853a.exe	17
PID 2108 wrote to memory of 2300	2108	3ca57720174052697f534d83cc0b853a.exe	17
PID 2300 wrote to memory of 2084	2300	3ca57720174052697f534d83cc0b853a.exe	16
PID 2300 wrote to memory of 2084	2300	3ca57720174052697f534d83cc0b853a.exe	16
PID 2300 wrote to memory of 2084	2300	3ca57720174052697f534d83cc0b853a.exe	16
PID 2300 wrote to memory of 2084	2300	3ca57720174052697f534d83cc0b853a.exe	16

C:\Users\Admin\AppData\Local\Temp\3ca57720174052697f534d83cc0b853a.exe
"C:\Users\Admin\AppData\Local\Temp\3ca57720174052697f534d83cc0b853a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Users\Admin\AppData\Local\Temp\3ca57720174052697f534d83cc0b853a.exe
  C:\Users\Admin\AppData\Local\Temp\3ca57720174052697f534d83cc0b853a.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 36
1⤵
- Program crash
PID:2084

memory/2300-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2300-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download