9b2384e01b2207393f383cac0640261837f7d2bc3d6cd701c2e08fd1cad362f1

Analysis

max time kernel
142s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23/08/2023, 03:23

Target

9b2384e01b2207393f383cac0640261837f7d2bc3d6cd701c2e08fd1cad362f1.exe
Size

1.4MB
MD5

ee6a8f042f195320db7336a804c089dc
SHA1

cd4a80b88d6fc682e4a0843b32fd5f563cab5961
SHA256

9b2384e01b2207393f383cac0640261837f7d2bc3d6cd701c2e08fd1cad362f1
SHA512

c765fa0e1223da191ac1c08c481aa7bdc0c89ca52095f8cba6be66d4f5f650dc583b34b6c0c2d32ef988075065a4813009b97669d47a754f28de77bc900af065
SSDEEP

24576:BViMJoH/8uIvJZXoUQ/MQ/amGHPP7cTFtSUMY/U8hd5o1o1Dqqef6e11ie:VJiJOoUQ/MIGHPP7cTCUMYr

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2376	YjLu0asVxyAf.exe

Loads dropped DLL 2 IoCs

pid	Process
2520	9b2384e01b2207393f383cac0640261837f7d2bc3d6cd701c2e08fd1cad362f1.exe
2520	9b2384e01b2207393f383cac0640261837f7d2bc3d6cd701c2e08fd1cad362f1.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1520	2520	WerFault.exe	27

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2376	2520	9b2384e01b2207393f383cac0640261837f7d2bc3d6cd701c2e08fd1cad362f1.exe	28
PID 2520 wrote to memory of 2376	2520	9b2384e01b2207393f383cac0640261837f7d2bc3d6cd701c2e08fd1cad362f1.exe	28
PID 2520 wrote to memory of 2376	2520	9b2384e01b2207393f383cac0640261837f7d2bc3d6cd701c2e08fd1cad362f1.exe	28
PID 2520 wrote to memory of 1520	2520	9b2384e01b2207393f383cac0640261837f7d2bc3d6cd701c2e08fd1cad362f1.exe	29
PID 2520 wrote to memory of 1520	2520	9b2384e01b2207393f383cac0640261837f7d2bc3d6cd701c2e08fd1cad362f1.exe	29
PID 2520 wrote to memory of 1520	2520	9b2384e01b2207393f383cac0640261837f7d2bc3d6cd701c2e08fd1cad362f1.exe	29

C:\Users\Admin\AppData\Local\Temp\9b2384e01b2207393f383cac0640261837f7d2bc3d6cd701c2e08fd1cad362f1.exe
"C:\Users\Admin\AppData\Local\Temp\9b2384e01b2207393f383cac0640261837f7d2bc3d6cd701c2e08fd1cad362f1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Users\Admin\YjLu0asVxyAf.exe
  C:\Users\Admin\YjLu0asVxyAf.exe start "C:\Users\Admin\AppData\Local\Temp\9b2384e01b2207393f383cac0640261837f7d2bc3d6cd701c2e08fd1cad362f1.exe" \\.\pipe\Winsock2\Slader-YjLu0asVxy
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2520 -s 152
  2⤵
  - Program crash
  PID:1520

C:\Users\Admin\YjLu0asVxyAf.exe

Filesize
1.4MB

MD5
ee6a8f042f195320db7336a804c089dc

SHA1
cd4a80b88d6fc682e4a0843b32fd5f563cab5961

SHA256
9b2384e01b2207393f383cac0640261837f7d2bc3d6cd701c2e08fd1cad362f1

SHA512
c765fa0e1223da191ac1c08c481aa7bdc0c89ca52095f8cba6be66d4f5f650dc583b34b6c0c2d32ef988075065a4813009b97669d47a754f28de77bc900af065

Download Submit
\Users\Admin\YjLu0asVxyAf.exe

Filesize
1.4MB

MD5
ee6a8f042f195320db7336a804c089dc

SHA1
cd4a80b88d6fc682e4a0843b32fd5f563cab5961

SHA256
9b2384e01b2207393f383cac0640261837f7d2bc3d6cd701c2e08fd1cad362f1

SHA512
c765fa0e1223da191ac1c08c481aa7bdc0c89ca52095f8cba6be66d4f5f650dc583b34b6c0c2d32ef988075065a4813009b97669d47a754f28de77bc900af065

Download Submit
\Users\Admin\YjLu0asVxyAf.exe

Filesize
1.4MB

MD5
ee6a8f042f195320db7336a804c089dc

SHA1
cd4a80b88d6fc682e4a0843b32fd5f563cab5961

SHA256
9b2384e01b2207393f383cac0640261837f7d2bc3d6cd701c2e08fd1cad362f1

SHA512
c765fa0e1223da191ac1c08c481aa7bdc0c89ca52095f8cba6be66d4f5f650dc583b34b6c0c2d32ef988075065a4813009b97669d47a754f28de77bc900af065

Download Submit
memory/2376-62-0x0000000000400000-0x0000000000570000-memory.dmp

Filesize
1.4MB

Download
memory/2520-61-0x0000000000400000-0x0000000000570000-memory.dmp

Filesize
1.4MB

Download