bfc092b384976e97153bae0e29359461bfd65fce5ad8188d6460de57bc680eaf

Analysis

max time kernel
32s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 08:50

Target

1/5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe
Size

719KB
MD5

a7d3bd55656bdc04c270315d083b59c1
SHA1

a76453791867e4aaf4cd0551b70e52ced80b3fab
SHA256

5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33
SHA512

9233bbbbaed1bafaa296ae332713d0374594443dea06df83ebc9934ae0341ac7366a91c47cdd9b0877313ad1bbbf9b747f34e7cf75a1a21816463791cfdea861
SSDEEP

12288:wY2iNiw9WMA4snu2lpaSgsDLRK8RP8dSWhdWyGLiOkV2IPePH:wY1UnH4olpaSgsDlK2PKSWnWyqiJ2q

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1048 set thread context of 1760	1048	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1808	1760	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1760	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1760	1048	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe	29
PID 1048 wrote to memory of 1760	1048	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe	29
PID 1048 wrote to memory of 1760	1048	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe	29
PID 1048 wrote to memory of 1760	1048	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe	29
PID 1048 wrote to memory of 1760	1048	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe	29
PID 1048 wrote to memory of 1760	1048	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe	29
PID 1048 wrote to memory of 1760	1048	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe	29
PID 1760 wrote to memory of 1808	1760	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe	30
PID 1760 wrote to memory of 1808	1760	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe	30
PID 1760 wrote to memory of 1808	1760	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe	30
PID 1760 wrote to memory of 1808	1760	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe	30

memory/1048-11-0x0000000074950000-0x000000007503E000-memory.dmp

Filesize
6.9MB

Download
memory/1048-1-0x0000000000C00000-0x0000000000CBA000-memory.dmp

Filesize
744KB

Download
memory/1048-2-0x0000000074950000-0x000000007503E000-memory.dmp

Filesize
6.9MB

Download
memory/1048-3-0x00000000003A0000-0x00000000003B0000-memory.dmp

Filesize
64KB

Download
memory/1048-4-0x00000000004C0000-0x00000000004CE000-memory.dmp

Filesize
56KB

Download
memory/1048-5-0x00000000052F0000-0x000000000537E000-memory.dmp

Filesize
568KB

Download
memory/1048-0-0x000000007495E000-0x000000007495F000-memory.dmp

Filesize
4KB

Download
memory/1760-7-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1760-10-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1760-6-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1760-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1760-12-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1760-13-0x0000000000CC0000-0x0000000000FC3000-memory.dmp

Filesize
3.0MB

Download
memory/1760-14-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download