7c49cb72f08f8d19e6ebaa77fcec17e2b0461204a7f79f2230b54a324e935252

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 00:15

Target

95be9ecd9e96d48182fe6a81aa5c4772.exe
Size

569KB
MD5

95be9ecd9e96d48182fe6a81aa5c4772
SHA1

8543bcef3c6c38989e4e5a25208684609642aa77
SHA256

7c49cb72f08f8d19e6ebaa77fcec17e2b0461204a7f79f2230b54a324e935252
SHA512

329ad3c2c6ba62376f5dbbd122af79e6fe2153d154e2e17a3bbb92b4cd26e3d519fda9fd95be36c9e31256095b10ce0f52d54ca4af935bc5b9ecc895b5fb6d73
SSDEEP

12288:aQUiJafmm2VYK+UNo0RweQfoAxHv9sN4A4H9J618UtQ43iUhcp:aQTVm2VZQwy9E1Vf3e

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1320 set thread context of 2160	1320	95be9ecd9e96d48182fe6a81aa5c4772.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1836	1320	WerFault.exe	27

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1320	95be9ecd9e96d48182fe6a81aa5c4772.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 2160	1320	95be9ecd9e96d48182fe6a81aa5c4772.exe	28
PID 1320 wrote to memory of 2160	1320	95be9ecd9e96d48182fe6a81aa5c4772.exe	28
PID 1320 wrote to memory of 2160	1320	95be9ecd9e96d48182fe6a81aa5c4772.exe	28
PID 1320 wrote to memory of 2160	1320	95be9ecd9e96d48182fe6a81aa5c4772.exe	28
PID 1320 wrote to memory of 2160	1320	95be9ecd9e96d48182fe6a81aa5c4772.exe	28
PID 1320 wrote to memory of 1836	1320	95be9ecd9e96d48182fe6a81aa5c4772.exe	29
PID 1320 wrote to memory of 1836	1320	95be9ecd9e96d48182fe6a81aa5c4772.exe	29
PID 1320 wrote to memory of 1836	1320	95be9ecd9e96d48182fe6a81aa5c4772.exe	29
PID 1320 wrote to memory of 1836	1320	95be9ecd9e96d48182fe6a81aa5c4772.exe	29

C:\Users\Admin\AppData\Local\Temp\95be9ecd9e96d48182fe6a81aa5c4772.exe
"C:\Users\Admin\AppData\Local\Temp\95be9ecd9e96d48182fe6a81aa5c4772.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Users\Admin\AppData\Local\Temp\95be9ecd9e96d48182fe6a81aa5c4772.exe
  "C:\Users\Admin\AppData\Local\Temp\95be9ecd9e96d48182fe6a81aa5c4772.exe"
  2⤵
  PID:2160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 164
  2⤵
  - Program crash
  PID:1836

memory/1320-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1320-1-0x00000000002C0000-0x00000000002C2000-memory.dmp

Filesize
8KB

Download
memory/2160-2-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download