cb1fbe869136895b54a4d8b6dab70f0c5dfddb9dd3ddea5598488d451b9ccf17

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
10/10/2022, 12:35

Target
cb1fbe869136895b54a4d8b6dab70f0c5dfddb9dd3ddea5598488d451b9ccf17.exe
Size 1.1MB
Sample221010-psb9xsbge3
SHA256 cb1fbe869136895b54a4d8b6dab70f0c5dfddb9dd3ddea5598488d451b9ccf17
MD5 7a96277f1571f24d24ae6fc89c85f50c
SHA1 ed08ac21192e41faf219778bf287ea282bbbcdeb
SHA512 b9bbc7e95aee50680e05ad57aa2726b2d2d5acec1f69d198b97792af8510e3ca7fce4279ff82f7688385f07610cb0c79f0b30d77eba4b0c87d2fada55e37a1d3
SSDEEP 12288:btb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNDPPpHrYlW0SQwh4r/Z:btb20pkaCqT5TBWgNjVYfSw9
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1204-55-0x0000000000D80000-0x0000000000E9D000-memory.dmp	autoit_exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	1204	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1696	1204	cb1fbe869136895b54a4d8b6dab70f0c5dfddb9dd3ddea5598488d451b9ccf17.exe	27
PID 1204 wrote to memory of 1696	1204	cb1fbe869136895b54a4d8b6dab70f0c5dfddb9dd3ddea5598488d451b9ccf17.exe	27
PID 1204 wrote to memory of 1696	1204	cb1fbe869136895b54a4d8b6dab70f0c5dfddb9dd3ddea5598488d451b9ccf17.exe	27
PID 1204 wrote to memory of 1696	1204	cb1fbe869136895b54a4d8b6dab70f0c5dfddb9dd3ddea5598488d451b9ccf17.exe	27

C:\Users\Admin\AppData\Local\Temp\cb1fbe869136895b54a4d8b6dab70f0c5dfddb9dd3ddea5598488d451b9ccf17.exe
"C:\Users\Admin\AppData\Local\Temp\cb1fbe869136895b54a4d8b6dab70f0c5dfddb9dd3ddea5598488d451b9ccf17.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 236
  2⤵
  - Program crash
  PID:1696

memory/1204-54-0x0000000074E41000-0x0000000074E43000-memory.dmp

Download

memory/1204-55-0x0000000000D80000-0x0000000000E9D000-memory.dmp

Download