280f20c2c477bddf374eee808192270b847ac0f5665c518ce9616dda53f96632

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 09:56

Target

4b2015a76f269f5f6a0a2cebe22fe4e9.exe
Size

531KB
MD5

4b2015a76f269f5f6a0a2cebe22fe4e9
SHA1

dbfc7cae20fd22fdfb61440cf47e8e7d5cfb787f
SHA256

280f20c2c477bddf374eee808192270b847ac0f5665c518ce9616dda53f96632
SHA512

e449fa33ae1b3b24b9f9e751a56c4319a460a5a96b3a064f514f36874560a57f85a1817c07b0c584ac3c785dff1d4d0372df06ffdfc7a01f3d7735886b8c4d3d
SSDEEP

12288:Q6IAqCqgsSkMhiFtuPDOH7z8LjUXrjrD8pR9B7bKA9QNrFB:0BEkMhi3Y07QLjUXrz8v9B72A9+r7

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2476 set thread context of 2144	2476	4b2015a76f269f5f6a0a2cebe22fe4e9.exe	16

Program crash 1 IoCs

pid	pid_target	Process
2856	2144	WerFault.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2144	2476	4b2015a76f269f5f6a0a2cebe22fe4e9.exe	16
PID 2476 wrote to memory of 2144	2476	4b2015a76f269f5f6a0a2cebe22fe4e9.exe	16
PID 2476 wrote to memory of 2144	2476	4b2015a76f269f5f6a0a2cebe22fe4e9.exe	16
PID 2476 wrote to memory of 2144	2476	4b2015a76f269f5f6a0a2cebe22fe4e9.exe	16
PID 2476 wrote to memory of 2144	2476	4b2015a76f269f5f6a0a2cebe22fe4e9.exe	16
PID 2476 wrote to memory of 2144	2476	4b2015a76f269f5f6a0a2cebe22fe4e9.exe	16
PID 2144 wrote to memory of 2856	2144	4b2015a76f269f5f6a0a2cebe22fe4e9.exe	15
PID 2144 wrote to memory of 2856	2144	4b2015a76f269f5f6a0a2cebe22fe4e9.exe	15
PID 2144 wrote to memory of 2856	2144	4b2015a76f269f5f6a0a2cebe22fe4e9.exe	15
PID 2144 wrote to memory of 2856	2144	4b2015a76f269f5f6a0a2cebe22fe4e9.exe	15

C:\Users\Admin\AppData\Local\Temp\4b2015a76f269f5f6a0a2cebe22fe4e9.exe
"C:\Users\Admin\AppData\Local\Temp\4b2015a76f269f5f6a0a2cebe22fe4e9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Users\Admin\AppData\Local\Temp\4b2015a76f269f5f6a0a2cebe22fe4e9.exe
  C:\Users\Admin\AppData\Local\Temp\4b2015a76f269f5f6a0a2cebe22fe4e9.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 88
1⤵
- Program crash
PID:2856

memory/2144-7-0x0000000044440000-0x0000000044457000-memory.dmp

Filesize
92KB

Download
memory/2144-6-0x0000000044440000-0x0000000044457000-memory.dmp

Filesize
92KB

Download
memory/2144-4-0x0000000044440000-0x0000000044457000-memory.dmp

Filesize
92KB

Download
memory/2144-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2144-1-0x0000000044440000-0x0000000044457000-memory.dmp

Filesize
92KB

Download
memory/2476-5-0x0000000010000000-0x0000000010082000-memory.dmp

Filesize
520KB

Download
memory/2476-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download