ee582ee912ef7b2be2b10f27ba59ca8f08dacd39819a7b2dff6d80e7c57f306a

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17-06-2023 01:40

Target

MouseWithoutBorders/MouseWithoutBorders.exe
Size

708KB
MD5

efd109d66c7683f1a6e8d96ccbc7a430
SHA1

9d3b2a12a637640a115f3744a19ee4257f025d92
SHA256

6eab4fc7bf845b3b9da3acd2924c11783149634fcd334486e1a21086d99c51c8
SHA512

5c9e205a1538ccaceea3ce1333f261a14ef2fbed5b21af262837ea4d09157125a155d7982090b95d29101dca648f68cf41e3633429c2c684f2787dff28a0fbaf
SSDEEP

6144:jGYHLEF70/FcFGhyRjafHJFg0mFzMsy32163UMAbbW1K0Jmha9+sGJGapn6uaigE:7HLEJGhyRjak0UgAVRy9SQM51j5fnK+

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1724 1376 WerFault.exe MouseWithoutBorders.exe

pid	pid_target	process	target process
1724	1376	WerFault.exe	MouseWithoutBorders.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

MouseWithoutBorders.exe

description	pid	process	target process
PID 1376 wrote to memory of 1724	1376	MouseWithoutBorders.exe	WerFault.exe
PID 1376 wrote to memory of 1724	1376	MouseWithoutBorders.exe	WerFault.exe
PID 1376 wrote to memory of 1724	1376	MouseWithoutBorders.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\MouseWithoutBorders\MouseWithoutBorders.exe
"C:\Users\Admin\AppData\Local\Temp\MouseWithoutBorders\MouseWithoutBorders.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1376

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1376 -s 536
2⤵
- Program crash
PID:1724

memory/1376-54-0x00000000010E0000-0x0000000001194000-memory.dmp

Filesize
720KB

Download