ffe2a83d37b7b5657de5c2c2d3fc3db3f4703a0b1a19a9964226eba696040b09

Analysis

max time kernel
45s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 18:02

Target

1433_hack44.cn/乌龙寺1433/FTPHEX/KSD.exe
Size

145KB
MD5

91a7afd5867df33ded475cb3b9d98a84
SHA1

3eba9d8a18c70119fc1cadcd7480155ab2239950
SHA256

81224f8f9450e3bf4370f8fdf6dccaae79d1b86f7cf74f2a7204e2f3ecb82491
SHA512

cb87bc7c495d4242e67b71210d48b454b31d21455478d96c95cac13c5113b53bed699ffaedc2ecf52168837171979f830b7d5cfa6598ee341e6114ff138840ea
SSDEEP

3072:5PQpbKAIiuB+ZLtHC5q/nsLkce2gpoZskMX2jGCPGd2RDI8p:5PhImEUgek2jGCeAh

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1992 960 WerFault.exe KSD.exe

pid	pid_target	process	target process
1992	960	WerFault.exe	KSD.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

KSD.exe

description	pid	process	target process
PID 960 wrote to memory of 1992	960	KSD.exe	WerFault.exe
PID 960 wrote to memory of 1992	960	KSD.exe	WerFault.exe
PID 960 wrote to memory of 1992	960	KSD.exe	WerFault.exe
PID 960 wrote to memory of 1992	960	KSD.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1433_hack44.cn\乌龙寺1433\FTPHEX\KSD.exe
"C:\Users\Admin\AppData\Local\Temp\1433_hack44.cn\乌龙寺1433\FTPHEX\KSD.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 152
2⤵
- Program crash
PID:1992