bc211fb14d89c72f3a39c4a72bbe455e0e7d62de998786594194a4bb4b80c242

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 01:07

Target

659460bd481e4c381f51fa9d78a7c0829227027ded6aa9ebaea73df0228f7686.exe
Size

664KB
MD5

0c48596b2ee50230aa406dfa7edb9d68
SHA1

75e442909af9a288b0cb18ed2fb831296475a9b7
SHA256

659460bd481e4c381f51fa9d78a7c0829227027ded6aa9ebaea73df0228f7686
SHA512

ce2df9c3b743f0ef836d670fd7b243d275b80540bb7291b767e7d511d4139213bfe28dcc2661fd0e0cf5ba9fbb75bb362c1c832518008642335e9da69838d67e
SSDEEP

12288:QGZI7VA5qpl1jpjELig917TzizqAnWqu7DJ9OiM55MNhYsyuUqyJMR:QmKjJmWzRnWquKRGssymOW

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2212 set thread context of 1284	2212	659460bd481e4c381f51fa9d78a7c0829227027ded6aa9ebaea73df0228f7686.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2664	1284	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1284	659460bd481e4c381f51fa9d78a7c0829227027ded6aa9ebaea73df0228f7686.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 1284	2212	659460bd481e4c381f51fa9d78a7c0829227027ded6aa9ebaea73df0228f7686.exe	28
PID 2212 wrote to memory of 1284	2212	659460bd481e4c381f51fa9d78a7c0829227027ded6aa9ebaea73df0228f7686.exe	28
PID 2212 wrote to memory of 1284	2212	659460bd481e4c381f51fa9d78a7c0829227027ded6aa9ebaea73df0228f7686.exe	28
PID 2212 wrote to memory of 1284	2212	659460bd481e4c381f51fa9d78a7c0829227027ded6aa9ebaea73df0228f7686.exe	28
PID 2212 wrote to memory of 1284	2212	659460bd481e4c381f51fa9d78a7c0829227027ded6aa9ebaea73df0228f7686.exe	28
PID 2212 wrote to memory of 1284	2212	659460bd481e4c381f51fa9d78a7c0829227027ded6aa9ebaea73df0228f7686.exe	28
PID 2212 wrote to memory of 1284	2212	659460bd481e4c381f51fa9d78a7c0829227027ded6aa9ebaea73df0228f7686.exe	28
PID 1284 wrote to memory of 2664	1284	659460bd481e4c381f51fa9d78a7c0829227027ded6aa9ebaea73df0228f7686.exe	29
PID 1284 wrote to memory of 2664	1284	659460bd481e4c381f51fa9d78a7c0829227027ded6aa9ebaea73df0228f7686.exe	29
PID 1284 wrote to memory of 2664	1284	659460bd481e4c381f51fa9d78a7c0829227027ded6aa9ebaea73df0228f7686.exe	29
PID 1284 wrote to memory of 2664	1284	659460bd481e4c381f51fa9d78a7c0829227027ded6aa9ebaea73df0228f7686.exe	29

memory/1284-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1284-15-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1284-14-0x0000000000820000-0x0000000000B23000-memory.dmp

Filesize
3.0MB

Download
memory/1284-12-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1284-7-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1284-8-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2212-3-0x0000000000490000-0x00000000004A6000-memory.dmp

Filesize
88KB

Download
memory/2212-6-0x0000000005030000-0x00000000050BA000-memory.dmp

Filesize
552KB

Download
memory/2212-5-0x0000000000610000-0x0000000000620000-memory.dmp

Filesize
64KB

Download
memory/2212-4-0x0000000000600000-0x000000000060E000-memory.dmp

Filesize
56KB

Download
memory/2212-0-0x00000000740EE000-0x00000000740EF000-memory.dmp

Filesize
4KB

Download
memory/2212-13-0x00000000740E0000-0x00000000747CE000-memory.dmp

Filesize
6.9MB

Download
memory/2212-2-0x00000000740E0000-0x00000000747CE000-memory.dmp

Filesize
6.9MB

Download
memory/2212-1-0x0000000000230000-0x00000000002DC000-memory.dmp

Filesize
688KB

Download