fbf3a7baa5927d504978c2e85715039f2329a12abd5260920f4ad0066c174493

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 10:09

Target

cb225661c987049bf363fa619496b15c.exe
Size

92KB
MD5

cb225661c987049bf363fa619496b15c
SHA1

c83f5383315ee42ca65127cb32f70ed10a1fe9d0
SHA256

fbf3a7baa5927d504978c2e85715039f2329a12abd5260920f4ad0066c174493
SHA512

538bc16ebcb721b071008362f9877a36e80ec580012f14f76700c9d584081d6e8cd48dbf8f68f535c4ad3eab4e02f1bfa1d0a252bd09d430502501e60da25d35
SSDEEP

1536:F8gzQb7cTO4YTnBlXpcn5RvPGZvaQqMOOg8WhwIED9pl4b:GgzKZ5TBlXi+7qM9g882Dzl4b

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

cb225661c987049bf363fa619496b15c.exe

description pid process target process

PID 1132 set thread context of 1744 1132 cb225661c987049bf363fa619496b15c.exe cb225661c987049bf363fa619496b15c.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2628 1744 WerFault.exe cb225661c987049bf363fa619496b15c.exe

description	pid	process	target process
PID 1132 set thread context of 1744	1132	cb225661c987049bf363fa619496b15c.exe	cb225661c987049bf363fa619496b15c.exe

pid	pid_target	process	target process
2628	1744	WerFault.exe	cb225661c987049bf363fa619496b15c.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

cb225661c987049bf363fa619496b15c.execb225661c987049bf363fa619496b15c.exe

description	pid	process	target process
PID 1132 wrote to memory of 1744	1132	cb225661c987049bf363fa619496b15c.exe	cb225661c987049bf363fa619496b15c.exe
PID 1132 wrote to memory of 1744	1132	cb225661c987049bf363fa619496b15c.exe	cb225661c987049bf363fa619496b15c.exe
PID 1132 wrote to memory of 1744	1132	cb225661c987049bf363fa619496b15c.exe	cb225661c987049bf363fa619496b15c.exe
PID 1132 wrote to memory of 1744	1132	cb225661c987049bf363fa619496b15c.exe	cb225661c987049bf363fa619496b15c.exe
PID 1132 wrote to memory of 1744	1132	cb225661c987049bf363fa619496b15c.exe	cb225661c987049bf363fa619496b15c.exe
PID 1132 wrote to memory of 1744	1132	cb225661c987049bf363fa619496b15c.exe	cb225661c987049bf363fa619496b15c.exe
PID 1132 wrote to memory of 1744	1132	cb225661c987049bf363fa619496b15c.exe	cb225661c987049bf363fa619496b15c.exe
PID 1132 wrote to memory of 1744	1132	cb225661c987049bf363fa619496b15c.exe	cb225661c987049bf363fa619496b15c.exe
PID 1132 wrote to memory of 1744	1132	cb225661c987049bf363fa619496b15c.exe	cb225661c987049bf363fa619496b15c.exe
PID 1744 wrote to memory of 2628	1744	cb225661c987049bf363fa619496b15c.exe	WerFault.exe
PID 1744 wrote to memory of 2628	1744	cb225661c987049bf363fa619496b15c.exe	WerFault.exe
PID 1744 wrote to memory of 2628	1744	cb225661c987049bf363fa619496b15c.exe	WerFault.exe
PID 1744 wrote to memory of 2628	1744	cb225661c987049bf363fa619496b15c.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\cb225661c987049bf363fa619496b15c.exe
"C:\Users\Admin\AppData\Local\Temp\cb225661c987049bf363fa619496b15c.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 44
3⤵
- Program crash
PID:2628

memory/1744-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1744-2-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1744-4-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1744-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1744-5-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1744-8-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1744-10-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1744-11-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download