eb8a15c412416b352921f4eb4f9586503e1c1c30b458d46b0df55c23c8a01aac

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19/07/2023, 09:48

Target

JXC.exe
Size

5.9MB
MD5

5037d5a83381fe6a73acdbaff8c6ea98
SHA1

323ddcb18f50aaf3541bf80264f4702d455b70fc
SHA256

eb8a15c412416b352921f4eb4f9586503e1c1c30b458d46b0df55c23c8a01aac
SHA512

805649077d6662ae6fe5c760528f9c9144b0943746b9b2f3f33ac95cb148c4780c1c30891b2f28ef5be923c9852a4fdb181f6d55a0498fe2fe2fb6364fad3166
SSDEEP

98304:7MWVmCCCYCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCHCCCYo:QKmCCCYCCCCCCCCCCCCCCCCCCCCCCCCx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2592	628	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 2592	628	JXC.exe	28
PID 628 wrote to memory of 2592	628	JXC.exe	28
PID 628 wrote to memory of 2592	628	JXC.exe	28
PID 628 wrote to memory of 2592	628	JXC.exe	28

C:\Users\Admin\AppData\Local\Temp\JXC.exe
"C:\Users\Admin\AppData\Local\Temp\JXC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 556
  2⤵
  - Program crash
  PID:2592

memory/628-54-0x0000000074350000-0x0000000074A3E000-memory.dmp

Filesize
6.9MB

Download
memory/628-55-0x0000000000020000-0x0000000000608000-memory.dmp

Filesize
5.9MB

Download
memory/628-56-0x0000000074350000-0x0000000074A3E000-memory.dmp

Filesize
6.9MB

Download