468f6d2d76ac4e2e840f63a6cd1df0e64a1c8cb575d1e0b3e9864d9fb7fd5212

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 18:49

Target

lSetup.exe
Size

202KB
MD5

64179e64675e822559cac6652298bdfc
SHA1

cceed3b2441146762512918af7bf7f89fb055583
SHA256

c26db97858c427d92e393396f7cb7f9e7ed8f9ce616adcc123d0ec6b055b99c9
SHA512

ef740b35ea5190f8ee47776af1f15ebdd54d39c84da5665e64f67ae6dd0f4b181e955e9a35319a5d0bd764972562e8f2bc44dbdf83c3bedf05674eae902e7280
SSDEEP

3072:EMtKztOp6KfOQqoY3ltdNjlcwsSdplkrxf+Uyecgw:ELKfOQLY3l9jlcwnlUf+z7gw

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

lSetup.exe

description pid process target process

PID 2352 set thread context of 1824 2352 lSetup.exe cmd.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2932 1824 WerFault.exe cmd.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

lSetup.execmd.exe

pid process

2352 lSetup.exe
2352 lSetup.exe
1824 cmd.exe
1824 cmd.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

lSetup.exe

pid process

2352 lSetup.exe

description	pid	process	target process
PID 2352 set thread context of 1824	2352	lSetup.exe	cmd.exe

pid	pid_target	process	target process
2932	1824	WerFault.exe	cmd.exe

pid	process
2352	lSetup.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

lSetup.execmd.exe

description	pid	process	target process
PID 2352 wrote to memory of 1824	2352	lSetup.exe	cmd.exe
PID 2352 wrote to memory of 1824	2352	lSetup.exe	cmd.exe
PID 2352 wrote to memory of 1824	2352	lSetup.exe	cmd.exe
PID 2352 wrote to memory of 1824	2352	lSetup.exe	cmd.exe
PID 2352 wrote to memory of 1824	2352	lSetup.exe	cmd.exe
PID 1824 wrote to memory of 2932	1824	cmd.exe	WerFault.exe
PID 1824 wrote to memory of 2932	1824	cmd.exe	WerFault.exe
PID 1824 wrote to memory of 2932	1824	cmd.exe	WerFault.exe
PID 1824 wrote to memory of 2932	1824	cmd.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 168
3⤵
- Program crash
PID:2932

C:\Users\Admin\AppData\Local\Temp\88e8436b

Filesize
1.2MB

MD5
a187be23e9bb64b56915f0f5684fdab6

SHA1
79abf4af50862990e210adf32a67b5144a862467

SHA256
7b675d1c536feb8e465db24c914c61301379da43cc539697632baa2f4a2d73fd

SHA512
180dc78bb51a9c55cfc384bed6ec306b0d172dc4e8078a1864ba87d94fa3a67bf47dca266082dbcd3974c0c27dd6de15dd70e1e04dc3a9c350998ee88434019f

Download Submit
memory/1824-13-0x0000000074720000-0x0000000074894000-memory.dmp

Filesize
1.5MB

Download
memory/1824-15-0x00000000772D0000-0x0000000077479000-memory.dmp

Filesize
1.7MB

Download
memory/1824-16-0x0000000072850000-0x00000000738B2000-memory.dmp

Filesize
16.4MB

Download
memory/1824-21-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1824-20-0x0000000074720000-0x0000000074894000-memory.dmp

Filesize
1.5MB

Download
memory/2352-0-0x0000000074720000-0x0000000074894000-memory.dmp

Filesize
1.5MB

Download
memory/2352-1-0x00000000772D0000-0x0000000077479000-memory.dmp

Filesize
1.7MB

Download
memory/2352-10-0x0000000074720000-0x0000000074894000-memory.dmp

Filesize
1.5MB

Download
memory/2352-11-0x0000000074720000-0x0000000074894000-memory.dmp

Filesize
1.5MB

Download