a23a6c4af10ac9eb38c1422fb7368958a41662bd52a157c63217c117f31dfade

Analysis

max time kernel
145s
max time network
85s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 00:01

Target

a23a6c4af10ac9eb38c1422fb7368958a41662bd52a157c63217c117f31dfade.exe
Size

74KB
MD5

0437b59f19460ba53d1f033cbb8a9fa6
SHA1

2baa467d0d736d331fdd59404099efe2786035d6
SHA256

a23a6c4af10ac9eb38c1422fb7368958a41662bd52a157c63217c117f31dfade
SHA512

da6bf2d6e34dcbf5f478bc06ab95814ada5569fc5a10eeb75692ae7385f4173a48600714039ad054c982ca1d1032660e6e7eb09fbc95342df84a2713da48b7c1
SSDEEP

1536:8+py7ZZA7zCCt4aUXrLOyJMf6IGv7U7jjcDSEYUu3LIxL3sgH2KRKpzZ:882kj4aUXr+wDU78DhYYxLzeZ

Score

4^/10

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\FreeRapid\1.bin	a23a6c4af10ac9eb38c1422fb7368958a41662bd52a157c63217c117f31dfade.exe
File created	C:\Program Files\FreeRapid\1.bat	a23a6c4af10ac9eb38c1422fb7368958a41662bd52a157c63217c117f31dfade.exe
File created	C:\Program Files\FreeRapid\2.bat	a23a6c4af10ac9eb38c1422fb7368958a41662bd52a157c63217c117f31dfade.exe
File created	C:\Program Files\FreeRapid\4.bat	a23a6c4af10ac9eb38c1422fb7368958a41662bd52a157c63217c117f31dfade.exe
File created	C:\Program Files\FreeRapid\loader.tmp	a23a6c4af10ac9eb38c1422fb7368958a41662bd52a157c63217c117f31dfade.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	1612	WerFault.exe	11

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1696	1612	a23a6c4af10ac9eb38c1422fb7368958a41662bd52a157c63217c117f31dfade.exe	29
PID 1612 wrote to memory of 1696	1612	a23a6c4af10ac9eb38c1422fb7368958a41662bd52a157c63217c117f31dfade.exe	29
PID 1612 wrote to memory of 1696	1612	a23a6c4af10ac9eb38c1422fb7368958a41662bd52a157c63217c117f31dfade.exe	29
PID 1612 wrote to memory of 1696	1612	a23a6c4af10ac9eb38c1422fb7368958a41662bd52a157c63217c117f31dfade.exe	29

C:\Users\Admin\AppData\Local\Temp\a23a6c4af10ac9eb38c1422fb7368958a41662bd52a157c63217c117f31dfade.exe
"C:\Users\Admin\AppData\Local\Temp\a23a6c4af10ac9eb38c1422fb7368958a41662bd52a157c63217c117f31dfade.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 668
  2⤵
  - Program crash
  PID:1696

memory/1612-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1612-55-0x00000000010A0000-0x00000000010DC000-memory.dmp

Filesize
240KB

Download
memory/1612-56-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/1612-58-0x00000000010A0000-0x00000000010DC000-memory.dmp

Filesize
240KB

Download