e60c4c5bea96445219862ae85e388fcc287ab8a87726e4836db591222b419e73

Analysis

max time kernel
142s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-02-2024 17:49

Target

a6f6242f4fde096ff32f39f979e3908a.exe
Size

184KB
MD5

a6f6242f4fde096ff32f39f979e3908a
SHA1

66c525eb15c769e15f05c05070526433bb0f40b6
SHA256

e60c4c5bea96445219862ae85e388fcc287ab8a87726e4836db591222b419e73
SHA512

88f66679bcc493c4e77c6863311d2ccb332c52d54da7142005f2cff071aa37cff0be5c274deb859a01ba518f70e7d25ccee95cdfb77179305667ec525467c3b4
SSDEEP

3072:WsOo1ZyHi/jxlGKcEpbmALjoc06+4vC8KsPVsxcBWj77i:dOSZyHi/jNCn74vCoPVsxSWHO

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

a6f6242f4fde096ff32f39f979e3908a.exe

description pid process target process

PID 2856 set thread context of 2608 2856 a6f6242f4fde096ff32f39f979e3908a.exe a6f6242f4fde096ff32f39f979e3908a.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2872 2608 WerFault.exe a6f6242f4fde096ff32f39f979e3908a.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

a6f6242f4fde096ff32f39f979e3908a.exe

pid process

2856 a6f6242f4fde096ff32f39f979e3908a.exe

description	pid	process	target process
PID 2856 set thread context of 2608	2856	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe

pid	pid_target	process	target process
2872	2608	WerFault.exe	a6f6242f4fde096ff32f39f979e3908a.exe

pid	process
2856	a6f6242f4fde096ff32f39f979e3908a.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

a6f6242f4fde096ff32f39f979e3908a.exea6f6242f4fde096ff32f39f979e3908a.exe

description	pid	process	target process
PID 2856 wrote to memory of 2608	2856	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 2856 wrote to memory of 2608	2856	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 2856 wrote to memory of 2608	2856	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 2856 wrote to memory of 2608	2856	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 2856 wrote to memory of 2608	2856	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 2856 wrote to memory of 2608	2856	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 2856 wrote to memory of 2608	2856	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 2856 wrote to memory of 2608	2856	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 2856 wrote to memory of 2608	2856	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 2856 wrote to memory of 2608	2856	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 2608 wrote to memory of 2872	2608	a6f6242f4fde096ff32f39f979e3908a.exe	WerFault.exe
PID 2608 wrote to memory of 2872	2608	a6f6242f4fde096ff32f39f979e3908a.exe	WerFault.exe
PID 2608 wrote to memory of 2872	2608	a6f6242f4fde096ff32f39f979e3908a.exe	WerFault.exe
PID 2608 wrote to memory of 2872	2608	a6f6242f4fde096ff32f39f979e3908a.exe	WerFault.exe

memory/2608-2-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2608-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2608-6-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2608-8-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download