7b90e51f5cb7828779c97681d5879c54e5e93bcad9bfac34d17efc6a8efab38a

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 01:18

Target

3f8865613b4aec2dab5388f4e4676882.exe
Size

451KB
MD5

3f8865613b4aec2dab5388f4e4676882
SHA1

e74f798128251d5d4484c83e54e68deec3d6ef2e
SHA256

7b90e51f5cb7828779c97681d5879c54e5e93bcad9bfac34d17efc6a8efab38a
SHA512

e5a723aa1b501074ad2419fa70629b852ab470e7f32243f91f408d38c1b6638cc137395a4b9b4ede084b638e4ace58f8f89633fd0116e2ac97df47cd1694fe99
SSDEEP

12288:tYMEGdAYnaa+SSOlE1NdNAgv4MOb4bIzRsTXfXCMOW:iAAYnBxBE1NdOgvwbGIzRsTXqMh

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1044 set thread context of 2032	1044	3f8865613b4aec2dab5388f4e4676882.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1932	1044	WerFault.exe	8

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2032	1044	3f8865613b4aec2dab5388f4e4676882.exe	28
PID 1044 wrote to memory of 2032	1044	3f8865613b4aec2dab5388f4e4676882.exe	28
PID 1044 wrote to memory of 2032	1044	3f8865613b4aec2dab5388f4e4676882.exe	28
PID 1044 wrote to memory of 2032	1044	3f8865613b4aec2dab5388f4e4676882.exe	28
PID 1044 wrote to memory of 2032	1044	3f8865613b4aec2dab5388f4e4676882.exe	28
PID 1044 wrote to memory of 2032	1044	3f8865613b4aec2dab5388f4e4676882.exe	28
PID 1044 wrote to memory of 1932	1044	3f8865613b4aec2dab5388f4e4676882.exe	29
PID 1044 wrote to memory of 1932	1044	3f8865613b4aec2dab5388f4e4676882.exe	29
PID 1044 wrote to memory of 1932	1044	3f8865613b4aec2dab5388f4e4676882.exe	29
PID 1044 wrote to memory of 1932	1044	3f8865613b4aec2dab5388f4e4676882.exe	29

C:\Users\Admin\AppData\Local\Temp\3f8865613b4aec2dab5388f4e4676882.exe
"C:\Users\Admin\AppData\Local\Temp\3f8865613b4aec2dab5388f4e4676882.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Users\Admin\AppData\Local\Temp\3f8865613b4aec2dab5388f4e4676882.exe
  C:\Users\Admin\AppData\Local\Temp\3f8865613b4aec2dab5388f4e4676882.exe
  2⤵
  PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 192
  2⤵
  - Program crash
  PID:1932

memory/1044-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1044-6-0x0000000010000000-0x0000000010079000-memory.dmp

Filesize
484KB

Download
memory/2032-1-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/2032-4-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/2032-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2032-5-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download