bde58e12d41cd833eb907de3955528c3ba4ea45f7e825b6ca038f74eaf594d26

Analysis

max time kernel
49s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
25/02/2023, 07:57

Target
606274728cade4d712e94215b1260156.exe
Size 665KB
Sample230225-js9mjacf23
SHA256 bde58e12d41cd833eb907de3955528c3ba4ea45f7e825b6ca038f74eaf594d26
MD5 606274728cade4d712e94215b1260156
SHA1 49a5384ab7c075078faf9a89526a32c212881310
SHA512 d65243a1b5ff47d17904242044404c8ddee2c8df26f08ac55883f612affa920535d9aa53936e6f10719588f7f0e95781ec9fc0f4b141f9ec9c1574fd4d1aeb4c
SSDEEP 12288:aqzGPs6Jl5OZtmEgQM8iDvirmB5GL39elZsYgQMpbRdu9qDSugDs+9t:Til5OZ0EgQM8eirzxqsYcpRSqDSu
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1028	1408	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 1028	1408	606274728cade4d712e94215b1260156.exe	28
PID 1408 wrote to memory of 1028	1408	606274728cade4d712e94215b1260156.exe	28
PID 1408 wrote to memory of 1028	1408	606274728cade4d712e94215b1260156.exe	28
PID 1408 wrote to memory of 1028	1408	606274728cade4d712e94215b1260156.exe	28

C:\Users\Admin\AppData\Local\Temp\606274728cade4d712e94215b1260156.exe
"C:\Users\Admin\AppData\Local\Temp\606274728cade4d712e94215b1260156.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 720
  2⤵
  - Program crash
  PID:1028

memory/1408-54-0x0000000001230000-0x00000000012DC000-memory.dmp

Download

memory/1408-55-0x0000000004E20000-0x0000000004E60000-memory.dmp

Download

memory/1408-56-0x00000000006B0000-0x00000000006C4000-memory.dmp

Download

memory/1408-57-0x0000000004E20000-0x0000000004E60000-memory.dmp

Download