939a09181702d4c4abdbe59cedd0e5bcc879c0428dbff7cd2c5dbbfb2c41e6b8

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05-02-2024 01:43

Target

90b4d0adc5484c2a382e41f28b84b96c.exe
Size

92KB
MD5

90b4d0adc5484c2a382e41f28b84b96c
SHA1

31a571625f2d8230edfb2432f47418f7651c8d94
SHA256

939a09181702d4c4abdbe59cedd0e5bcc879c0428dbff7cd2c5dbbfb2c41e6b8
SHA512

981b41a0a2a7e42a061b155e21df97fb951cc1bc9061dfa35b6c9f7ce6e57b42815eb4d5e7c282e6e35bb1feb5d2c98ed42ff22884a4478d5b4226efb664d96f
SSDEEP

1536:vIgY3oaTmEY3bdlny8sPHvvICymQ+I/NQUUGlkQUIVez3BT3VtOZjPivB:AgY34t3plWgCyx+hlzztOiB

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

90b4d0adc5484c2a382e41f28b84b96c.exe

description pid process target process

PID 3020 set thread context of 3036 3020 90b4d0adc5484c2a382e41f28b84b96c.exe 90b4d0adc5484c2a382e41f28b84b96c.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process

1448 3036 WerFault.exe

description	pid	process	target process
PID 3020 set thread context of 3036	3020	90b4d0adc5484c2a382e41f28b84b96c.exe	90b4d0adc5484c2a382e41f28b84b96c.exe

pid	pid_target	process
1448	3036	WerFault.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

90b4d0adc5484c2a382e41f28b84b96c.exe90b4d0adc5484c2a382e41f28b84b96c.exe

description	pid	process	target process
PID 3020 wrote to memory of 3036	3020	90b4d0adc5484c2a382e41f28b84b96c.exe	90b4d0adc5484c2a382e41f28b84b96c.exe
PID 3020 wrote to memory of 3036	3020	90b4d0adc5484c2a382e41f28b84b96c.exe	90b4d0adc5484c2a382e41f28b84b96c.exe
PID 3020 wrote to memory of 3036	3020	90b4d0adc5484c2a382e41f28b84b96c.exe	90b4d0adc5484c2a382e41f28b84b96c.exe
PID 3020 wrote to memory of 3036	3020	90b4d0adc5484c2a382e41f28b84b96c.exe	90b4d0adc5484c2a382e41f28b84b96c.exe
PID 3020 wrote to memory of 3036	3020	90b4d0adc5484c2a382e41f28b84b96c.exe	90b4d0adc5484c2a382e41f28b84b96c.exe
PID 3020 wrote to memory of 3036	3020	90b4d0adc5484c2a382e41f28b84b96c.exe	90b4d0adc5484c2a382e41f28b84b96c.exe
PID 3020 wrote to memory of 3036	3020	90b4d0adc5484c2a382e41f28b84b96c.exe	90b4d0adc5484c2a382e41f28b84b96c.exe
PID 3020 wrote to memory of 3036	3020	90b4d0adc5484c2a382e41f28b84b96c.exe	90b4d0adc5484c2a382e41f28b84b96c.exe
PID 3020 wrote to memory of 3036	3020	90b4d0adc5484c2a382e41f28b84b96c.exe	90b4d0adc5484c2a382e41f28b84b96c.exe
PID 3036 wrote to memory of 1448	3036	90b4d0adc5484c2a382e41f28b84b96c.exe	WerFault.exe
PID 3036 wrote to memory of 1448	3036	90b4d0adc5484c2a382e41f28b84b96c.exe	WerFault.exe
PID 3036 wrote to memory of 1448	3036	90b4d0adc5484c2a382e41f28b84b96c.exe	WerFault.exe
PID 3036 wrote to memory of 1448	3036	90b4d0adc5484c2a382e41f28b84b96c.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\90b4d0adc5484c2a382e41f28b84b96c.exe
"C:\Users\Admin\AppData\Local\Temp\90b4d0adc5484c2a382e41f28b84b96c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Local\Temp\90b4d0adc5484c2a382e41f28b84b96c.exe
  "C:\Users\Admin\AppData\Local\Temp\90b4d0adc5484c2a382e41f28b84b96c.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 44
1⤵
- Program crash
PID:1448

memory/3036-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3036-11-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3036-10-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3036-8-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3036-5-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3036-4-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3036-2-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3036-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download