d801b852dbc81c78360f91a305961c5ebdb6e47df32fc20e64cb5d3dc19d10fc

Analysis

max time kernel
143s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03-02-2024 08:52

Target

8bea899ee7308e3fa0030fcf9115106a.exe
Size

92KB
MD5

8bea899ee7308e3fa0030fcf9115106a
SHA1

7c776512e7fee15a6cf62ef0398f67b2cb65cadf
SHA256

d801b852dbc81c78360f91a305961c5ebdb6e47df32fc20e64cb5d3dc19d10fc
SHA512

8a663ccec9aec9f97e6662d96a051e4a8a3969ca6d14bd60f3f007fc7db2c192bae9f644ded6c57d1517069cf861368466e3ff208a4f65a647df687bb75fa348
SSDEEP

1536:/tgQloLYPNqYrlHEtsvm1f9FOt6/GoxdtnglJMAlX2EVdlBeUxpra8iL89Oiw+Md:VgQFPsElktQu9Fs6/G4dVVC2EblZraR3

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

8bea899ee7308e3fa0030fcf9115106a.exe

description pid process target process

PID 3008 set thread context of 2124 3008 8bea899ee7308e3fa0030fcf9115106a.exe 8bea899ee7308e3fa0030fcf9115106a.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2840 2124 WerFault.exe 8bea899ee7308e3fa0030fcf9115106a.exe

description	pid	process	target process
PID 3008 set thread context of 2124	3008	8bea899ee7308e3fa0030fcf9115106a.exe	8bea899ee7308e3fa0030fcf9115106a.exe

pid	pid_target	process	target process
2840	2124	WerFault.exe	8bea899ee7308e3fa0030fcf9115106a.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

8bea899ee7308e3fa0030fcf9115106a.exe8bea899ee7308e3fa0030fcf9115106a.exe

description	pid	process	target process
PID 3008 wrote to memory of 2124	3008	8bea899ee7308e3fa0030fcf9115106a.exe	8bea899ee7308e3fa0030fcf9115106a.exe
PID 3008 wrote to memory of 2124	3008	8bea899ee7308e3fa0030fcf9115106a.exe	8bea899ee7308e3fa0030fcf9115106a.exe
PID 3008 wrote to memory of 2124	3008	8bea899ee7308e3fa0030fcf9115106a.exe	8bea899ee7308e3fa0030fcf9115106a.exe
PID 3008 wrote to memory of 2124	3008	8bea899ee7308e3fa0030fcf9115106a.exe	8bea899ee7308e3fa0030fcf9115106a.exe
PID 3008 wrote to memory of 2124	3008	8bea899ee7308e3fa0030fcf9115106a.exe	8bea899ee7308e3fa0030fcf9115106a.exe
PID 3008 wrote to memory of 2124	3008	8bea899ee7308e3fa0030fcf9115106a.exe	8bea899ee7308e3fa0030fcf9115106a.exe
PID 3008 wrote to memory of 2124	3008	8bea899ee7308e3fa0030fcf9115106a.exe	8bea899ee7308e3fa0030fcf9115106a.exe
PID 3008 wrote to memory of 2124	3008	8bea899ee7308e3fa0030fcf9115106a.exe	8bea899ee7308e3fa0030fcf9115106a.exe
PID 3008 wrote to memory of 2124	3008	8bea899ee7308e3fa0030fcf9115106a.exe	8bea899ee7308e3fa0030fcf9115106a.exe
PID 2124 wrote to memory of 2840	2124	8bea899ee7308e3fa0030fcf9115106a.exe	WerFault.exe
PID 2124 wrote to memory of 2840	2124	8bea899ee7308e3fa0030fcf9115106a.exe	WerFault.exe
PID 2124 wrote to memory of 2840	2124	8bea899ee7308e3fa0030fcf9115106a.exe	WerFault.exe
PID 2124 wrote to memory of 2840	2124	8bea899ee7308e3fa0030fcf9115106a.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8bea899ee7308e3fa0030fcf9115106a.exe
"C:\Users\Admin\AppData\Local\Temp\8bea899ee7308e3fa0030fcf9115106a.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 44
3⤵
- Program crash
PID:2840

memory/2124-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2124-2-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2124-4-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2124-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2124-5-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2124-8-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2124-10-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2124-11-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download