b5310666a5cf6959c4f2ebcd1988a743197399fd9ad05286d9a8a07a3a1be8fd

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
27/03/2023, 10:07

Target

Suscribete a KuasaR/Unpark CPU/UnparkCPU.vshost.exe
Size

11KB
MD5

02be6d33b1edbc61c79882d3f556bd8a
SHA1

8d0afa78893ae5f04e505db0d76d0d50cf34e7da
SHA256

4c9f9b9de2ffeea9ccc6524d05ea5b78a14c1642cecc189fe40e7a57a6c294b3
SHA512

39949d9a14a17d7cf31aa222a6547be7663673872d5091a77c64b0cd863e399dcdfbff70443bc9a2c2dccc658a998afc5189469723bb5f4c8adeecab47b07967
SSDEEP

192:LzoWn3xB1BfWKnWZQKPnEtObMacxc8hjeyveCf0pnvC:ZhNfWKnWZLXci2jpv8vC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1092	2040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1092	2040	UnparkCPU.vshost.exe	28
PID 2040 wrote to memory of 1092	2040	UnparkCPU.vshost.exe	28
PID 2040 wrote to memory of 1092	2040	UnparkCPU.vshost.exe	28
PID 2040 wrote to memory of 1092	2040	UnparkCPU.vshost.exe	28

C:\Users\Admin\AppData\Local\Temp\Suscribete a KuasaR\Unpark CPU\UnparkCPU.vshost.exe
"C:\Users\Admin\AppData\Local\Temp\Suscribete a KuasaR\Unpark CPU\UnparkCPU.vshost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 536
  2⤵
  - Program crash
  PID:1092

memory/2040-54-0x0000000000240000-0x0000000000248000-memory.dmp

Filesize
32KB

Download