d7c7c435f1a15f42c22996c857678fd5d4e9618b1ea9425900da123506d0ddd7

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19/07/2023, 12:02

Target
EdMKlRedZoZMv2Y.exe
Size 629KB
Sample230719-n7fefsec28
SHA256 d7c7c435f1a15f42c22996c857678fd5d4e9618b1ea9425900da123506d0ddd7
MD5 0f117fd5a549922b60f51c2b24104227
SHA1 0192128d003425c376b43ee2c68479bbc6973026
SHA512 b235d3c5f3cc5f7542a0e45ac1fb042d0bedc35319f6a0bbfa0efadbd404eb0f3de7d199c00a526534027786a4ebadb222a493e27fe37f1544f19da593f3c8a0
SSDEEP 12288:SIPYPfY7BRttxJOwPlEj/53LTjG9ew9avWEgjkc:HPYPgJtxJOKEjB3/aMw9Y
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2924	2916	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2924	2916	EdMKlRedZoZMv2Y.exe	30
PID 2916 wrote to memory of 2924	2916	EdMKlRedZoZMv2Y.exe	30
PID 2916 wrote to memory of 2924	2916	EdMKlRedZoZMv2Y.exe	30
PID 2916 wrote to memory of 2924	2916	EdMKlRedZoZMv2Y.exe	30

C:\Users\Admin\AppData\Local\Temp\EdMKlRedZoZMv2Y.exe
"C:\Users\Admin\AppData\Local\Temp\EdMKlRedZoZMv2Y.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 680
  2⤵
  - Program crash
  PID:2924

memory/2916-54-0x0000000000BC0000-0x0000000000C64000-memory.dmp

Download

memory/2916-55-0x0000000073CE0000-0x00000000743CE000-memory.dmp

Download

memory/2916-56-0x00000000049E0000-0x0000000004A20000-memory.dmp

Download

memory/2916-57-0x0000000000370000-0x000000000037E000-memory.dmp

Download

memory/2916-58-0x0000000073CE0000-0x00000000743CE000-memory.dmp

Download

memory/2916-59-0x00000000049E0000-0x0000000004A20000-memory.dmp

Download

memory/2916-60-0x0000000000510000-0x000000000051A000-memory.dmp

Download