85befba77a3bb1b50c1192d10fddd913ad927adbce5f404ea43e2be617a68543

Analysis

max time kernel
42s
max time network
16s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 19:50

Target

Executor.exe
Size

284KB
MD5

246558ed006f01b60498078cfa630990
SHA1

e8b28476ca22c13c7854d4977ae9a4fc0c6c0aaa
SHA256

85befba77a3bb1b50c1192d10fddd913ad927adbce5f404ea43e2be617a68543
SHA512

2d74dbb8f1e146ed0d77c87b711a7c452f483bfbde702956abff832cd5b96ba5984eeb3b2786e51e365f655ecfac146dba610cd9a898355d5bdf0f611311edcd
SSDEEP

6144:IvGq/DOrjFEjeW9G+9EEj+3zEf7/jEDcHxTA8dCk:g//DO3ejs+9EpYDIqUq

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

Executor.exe

description pid process target process

PID 1220 set thread context of 2468 1220 Executor.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2620 2468 WerFault.exe RegAsm.exe

description	pid	process	target process
PID 1220 set thread context of 2468	1220	Executor.exe	RegAsm.exe

pid	pid_target	process	target process
2620	2468	WerFault.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

Executor.exeRegAsm.exe

description	pid	process	target process
PID 1220 wrote to memory of 2468	1220	Executor.exe	RegAsm.exe
PID 1220 wrote to memory of 2468	1220	Executor.exe	RegAsm.exe
PID 1220 wrote to memory of 2468	1220	Executor.exe	RegAsm.exe
PID 1220 wrote to memory of 2468	1220	Executor.exe	RegAsm.exe
PID 1220 wrote to memory of 2468	1220	Executor.exe	RegAsm.exe
PID 1220 wrote to memory of 2468	1220	Executor.exe	RegAsm.exe
PID 1220 wrote to memory of 2468	1220	Executor.exe	RegAsm.exe
PID 1220 wrote to memory of 2468	1220	Executor.exe	RegAsm.exe
PID 1220 wrote to memory of 2468	1220	Executor.exe	RegAsm.exe
PID 1220 wrote to memory of 2468	1220	Executor.exe	RegAsm.exe
PID 1220 wrote to memory of 2468	1220	Executor.exe	RegAsm.exe
PID 1220 wrote to memory of 2468	1220	Executor.exe	RegAsm.exe
PID 1220 wrote to memory of 2468	1220	Executor.exe	RegAsm.exe
PID 2468 wrote to memory of 2620	2468	RegAsm.exe	WerFault.exe
PID 2468 wrote to memory of 2620	2468	RegAsm.exe	WerFault.exe
PID 2468 wrote to memory of 2620	2468	RegAsm.exe	WerFault.exe
PID 2468 wrote to memory of 2620	2468	RegAsm.exe	WerFault.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 256
3⤵
- Program crash
PID:2620

memory/1220-0-0x00000000003A0000-0x00000000003EE000-memory.dmp

Filesize
312KB

Download
memory/1220-1-0x0000000074390000-0x0000000074A7E000-memory.dmp

Filesize
6.9MB

Download
memory/1220-4-0x00000000022D0000-0x00000000042D0000-memory.dmp

Filesize
32.0MB

Download
memory/1220-15-0x0000000074390000-0x0000000074A7E000-memory.dmp

Filesize
6.9MB

Download
memory/2468-8-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2468-7-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2468-6-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2468-9-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2468-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2468-11-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2468-14-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2468-5-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2468-16-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2468-17-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download