c5bec757bbcb8ba9a7b84d27b3d34717c289a5000d4b3fe307937719edfd243c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05-06-2024 12:57

Target

a32d858257c0013c7f291ff9c312ead6.exe
Size

466KB
MD5

a32d858257c0013c7f291ff9c312ead6
SHA1

8842a6d2e19ce562c9b87da1046b7369fae11ec4
SHA256

c5bec757bbcb8ba9a7b84d27b3d34717c289a5000d4b3fe307937719edfd243c
SHA512

ae64564957eafdb598e753d916ecf1bb655870fb5ee74dcdf1fd57f5baabd84f10a01ef1e2ef3b27fb3d907342d7d63d2dc878d5fc61e75a591654ede538995f
SSDEEP

12288:ul2TzR34llz14UYnaXYMhTjROuLh7SNwMGw5pia:u6oPz0nhk8ud70wMGw

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

a32d858257c0013c7f291ff9c312ead6.exe

description pid process target process

PID 2024 set thread context of 1660 2024 a32d858257c0013c7f291ff9c312ead6.exe a32d858257c0013c7f291ff9c312ead6.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2704 1660 WerFault.exe a32d858257c0013c7f291ff9c312ead6.exe

description	pid	process	target process
PID 2024 set thread context of 1660	2024	a32d858257c0013c7f291ff9c312ead6.exe	a32d858257c0013c7f291ff9c312ead6.exe

pid	pid_target	process	target process
2704	1660	WerFault.exe	a32d858257c0013c7f291ff9c312ead6.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

a32d858257c0013c7f291ff9c312ead6.exea32d858257c0013c7f291ff9c312ead6.exe

description	pid	process	target process
PID 2024 wrote to memory of 1660	2024	a32d858257c0013c7f291ff9c312ead6.exe	a32d858257c0013c7f291ff9c312ead6.exe
PID 2024 wrote to memory of 1660	2024	a32d858257c0013c7f291ff9c312ead6.exe	a32d858257c0013c7f291ff9c312ead6.exe
PID 2024 wrote to memory of 1660	2024	a32d858257c0013c7f291ff9c312ead6.exe	a32d858257c0013c7f291ff9c312ead6.exe
PID 2024 wrote to memory of 1660	2024	a32d858257c0013c7f291ff9c312ead6.exe	a32d858257c0013c7f291ff9c312ead6.exe
PID 2024 wrote to memory of 1660	2024	a32d858257c0013c7f291ff9c312ead6.exe	a32d858257c0013c7f291ff9c312ead6.exe
PID 2024 wrote to memory of 1660	2024	a32d858257c0013c7f291ff9c312ead6.exe	a32d858257c0013c7f291ff9c312ead6.exe
PID 2024 wrote to memory of 1660	2024	a32d858257c0013c7f291ff9c312ead6.exe	a32d858257c0013c7f291ff9c312ead6.exe
PID 1660 wrote to memory of 2704	1660	a32d858257c0013c7f291ff9c312ead6.exe	WerFault.exe
PID 1660 wrote to memory of 2704	1660	a32d858257c0013c7f291ff9c312ead6.exe	WerFault.exe
PID 1660 wrote to memory of 2704	1660	a32d858257c0013c7f291ff9c312ead6.exe	WerFault.exe
PID 1660 wrote to memory of 2704	1660	a32d858257c0013c7f291ff9c312ead6.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a32d858257c0013c7f291ff9c312ead6.exe
"C:\Users\Admin\AppData\Local\Temp\a32d858257c0013c7f291ff9c312ead6.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 36
3⤵
- Program crash
PID:2704

memory/1660-10-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1660-8-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1660-7-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1660-5-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2024-0-0x00000000744FE000-0x00000000744FF000-memory.dmp

Filesize
4KB

Download
memory/2024-1-0x0000000000B90000-0x0000000000C0A000-memory.dmp

Filesize
488KB

Download
memory/2024-2-0x0000000004740000-0x00000000047B6000-memory.dmp

Filesize
472KB

Download
memory/2024-3-0x00000000744F0000-0x0000000074BDE000-memory.dmp

Filesize
6.9MB

Download
memory/2024-4-0x0000000000590000-0x0000000000598000-memory.dmp

Filesize
32KB

Download
memory/2024-11-0x00000000744F0000-0x0000000074BDE000-memory.dmp

Filesize
6.9MB

Download