712786c767bcf64a4a20412ca4e0e0d8bb28dd696e800c7f45bec0a3524a99a3

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 21:20

Target

1cc818ea40e3921cc66f5f3f3d0ffb9d.exe
Size

1KB
MD5

1cc818ea40e3921cc66f5f3f3d0ffb9d
SHA1

52fe608b3c9363ec918777d757de8a3de1688dc7
SHA256

712786c767bcf64a4a20412ca4e0e0d8bb28dd696e800c7f45bec0a3524a99a3
SHA512

408d0f9212f4df5f5afa7107e565272d12a8d9effc2461cfc6a324b8251be9ccf8ae5d6296fbc565251b486fc5d1158e25bdaa49d5322b2be9569f03021daf26

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2440	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2396	1792	WerFault.exe	29

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2440	2548	1cc818ea40e3921cc66f5f3f3d0ffb9d.exe	28
PID 2548 wrote to memory of 2440	2548	1cc818ea40e3921cc66f5f3f3d0ffb9d.exe	28
PID 2548 wrote to memory of 2440	2548	1cc818ea40e3921cc66f5f3f3d0ffb9d.exe	28
PID 2548 wrote to memory of 2440	2548	1cc818ea40e3921cc66f5f3f3d0ffb9d.exe	28
PID 2548 wrote to memory of 1792	2548	1cc818ea40e3921cc66f5f3f3d0ffb9d.exe	29
PID 2548 wrote to memory of 1792	2548	1cc818ea40e3921cc66f5f3f3d0ffb9d.exe	29
PID 2548 wrote to memory of 1792	2548	1cc818ea40e3921cc66f5f3f3d0ffb9d.exe	29
PID 2548 wrote to memory of 1792	2548	1cc818ea40e3921cc66f5f3f3d0ffb9d.exe	29
PID 2548 wrote to memory of 1792	2548	1cc818ea40e3921cc66f5f3f3d0ffb9d.exe	29
PID 1792 wrote to memory of 2396	1792	svchost.exe	31
PID 1792 wrote to memory of 2396	1792	svchost.exe	31
PID 1792 wrote to memory of 2396	1792	svchost.exe	31
PID 1792 wrote to memory of 2396	1792	svchost.exe	31

C:\Users\Admin\AppData\Local\Temp\1cc818ea40e3921cc66f5f3f3d0ffb9d.exe
"C:\Users\Admin\AppData\Local\Temp\1cc818ea40e3921cc66f5f3f3d0ffb9d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c.bat C:\Users\Admin\AppData\Local\Temp\1cc818ea40e3921cc66f5f3f3d0ffb9d.exe
  2⤵
  - Deletes itself
  PID:2440
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 52
    3⤵
    - Program crash
    PID:2396

C:\Users\Admin\AppData\Local\Temp\c.bat

Filesize
404B

MD5
6c2f63698a08b310db71328b270a24f7

SHA1
dbfc63343722e2b7860b58d64cc89081207ed6d2

SHA256
38f8f02665b6dc6653faf8d93bcd98b61af2d8d080f8eb37d14938838b0c220e

SHA512
218708d4251186eca1b53d62067d6d2bea2c3dbfc937984cd26172d99f3f6f38a81a7fbc470da2d9df8d1185bc69468a2fcfc7de7cfa6291fa913fb71c2c5e8d

Download Submit
memory/1792-8-0x0000000000A70000-0x0000000000A78000-memory.dmp

Filesize
32KB

Download
memory/2548-7-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download