4b3d9ce87bed0226b6f029f12b219b8ff7d284b60ddf4d95708eb9ed7820ddc6

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:21

Target

37c70f861242dcff3c60c939a567e3a2.exe
Size

2KB
MD5

37c70f861242dcff3c60c939a567e3a2
SHA1

3e119df2e2c1bb0c9a1511604c3f0559cac9971f
SHA256

4b3d9ce87bed0226b6f029f12b219b8ff7d284b60ddf4d95708eb9ed7820ddc6
SHA512

a680769679f103662c92afbcfa7113b9e082b0a6e635a246911e68f9f36c5da0531cdfffbe768ef87e3c4a0660a8b8915032db55f1660d0a0ca68059d2ef14fa

Score

7^/10

Deletes itself 1 IoCs

pid	Process
616	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2932	2352	WerFault.exe	29

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 616	2928	37c70f861242dcff3c60c939a567e3a2.exe	30
PID 2928 wrote to memory of 616	2928	37c70f861242dcff3c60c939a567e3a2.exe	30
PID 2928 wrote to memory of 616	2928	37c70f861242dcff3c60c939a567e3a2.exe	30
PID 2928 wrote to memory of 616	2928	37c70f861242dcff3c60c939a567e3a2.exe	30
PID 2928 wrote to memory of 2352	2928	37c70f861242dcff3c60c939a567e3a2.exe	29
PID 2928 wrote to memory of 2352	2928	37c70f861242dcff3c60c939a567e3a2.exe	29
PID 2928 wrote to memory of 2352	2928	37c70f861242dcff3c60c939a567e3a2.exe	29
PID 2928 wrote to memory of 2352	2928	37c70f861242dcff3c60c939a567e3a2.exe	29
PID 2928 wrote to memory of 2352	2928	37c70f861242dcff3c60c939a567e3a2.exe	29
PID 2352 wrote to memory of 2932	2352	svchost.exe	31
PID 2352 wrote to memory of 2932	2352	svchost.exe	31
PID 2352 wrote to memory of 2932	2352	svchost.exe	31
PID 2352 wrote to memory of 2932	2352	svchost.exe	31

C:\Users\Admin\AppData\Local\Temp\37c70f861242dcff3c60c939a567e3a2.exe
"C:\Users\Admin\AppData\Local\Temp\37c70f861242dcff3c60c939a567e3a2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 52
    3⤵
    - Program crash
    PID:2932
- C:\Windows\SysWOW64\cmd.exe
  cmd /c d.bat C:\Users\Admin\AppData\Local\Temp\37c70f861242dcff3c60c939a567e3a2.exe
  2⤵
  - Deletes itself
  PID:616

C:\Users\Admin\AppData\Local\Temp\d.bat

Filesize
404B

MD5
6c2f63698a08b310db71328b270a24f7

SHA1
dbfc63343722e2b7860b58d64cc89081207ed6d2

SHA256
38f8f02665b6dc6653faf8d93bcd98b61af2d8d080f8eb37d14938838b0c220e

SHA512
218708d4251186eca1b53d62067d6d2bea2c3dbfc937984cd26172d99f3f6f38a81a7fbc470da2d9df8d1185bc69468a2fcfc7de7cfa6291fa913fb71c2c5e8d

Download Submit
memory/2352-9-0x0000000000D30000-0x0000000000D38000-memory.dmp

Filesize
32KB

Download
memory/2928-8-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download