6e80ae97afbf03d607739d56573ca1bfed33928a92e54cf25b809c1eb4be41f4

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02/01/2024, 00:28

Target

3e41b66bf25239d4a6fd4988ed815e9a.exe
Size

49KB
MD5

3e41b66bf25239d4a6fd4988ed815e9a
SHA1

e3b0cdcbf16d8fb7e9ac9dd7c1a62a2cffada4e0
SHA256

6e80ae97afbf03d607739d56573ca1bfed33928a92e54cf25b809c1eb4be41f4
SHA512

4addc4f84c20951ac4e7a374a1e877e7501a96a66202187b70d430053595f5b2098118b26db7c72bc5c522c7e0841292519842e97b841024409544bb67905a85
SSDEEP

768:xhO6ehxebu/cMnvhjj4fisQi/h7Te4+ykYVo:xUnxea0GvRcjN7Te4hkAo

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
756	tmp.exe

Loads dropped DLL 3 IoCs

Program crash 1 IoCs

pid	pid_target	Process
940	756	WerFault.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 756	3036	3e41b66bf25239d4a6fd4988ed815e9a.exe	29
PID 3036 wrote to memory of 756	3036	3e41b66bf25239d4a6fd4988ed815e9a.exe	29
PID 3036 wrote to memory of 756	3036	3e41b66bf25239d4a6fd4988ed815e9a.exe	29
PID 3036 wrote to memory of 756	3036	3e41b66bf25239d4a6fd4988ed815e9a.exe	29
PID 756 wrote to memory of 940	756	tmp.exe	28
PID 756 wrote to memory of 940	756	tmp.exe	28
PID 756 wrote to memory of 940	756	tmp.exe	28
PID 756 wrote to memory of 940	756	tmp.exe	28

C:\Users\Admin\AppData\Local\Temp\3e41b66bf25239d4a6fd4988ed815e9a.exe
"C:\Users\Admin\AppData\Local\Temp\3e41b66bf25239d4a6fd4988ed815e9a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  C:\Users\Admin\AppData\Local\Temp\tmp.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:756

C:\Users\Admin\AppData\Local\Temp\tmp.exe

Filesize
8KB

MD5
10cf617044b51c96a577b733f5255c46

SHA1
3607f3af2dd114746b632df8716c8606789fb35c

SHA256
e80d131b4a965bb0adb7e7a33bceb00865c18be0a31bb9e1c24ae8d9e90f64b0

SHA512
4c2353723c925e4ce35e34c8186cea60699d807bc1ac5a880604c9847025b27c164bc963c947c62d8e7ce3827de4779035f913fdee64dd3fa6be197c9847445b

Download Submit
memory/756-18-0x0000000000400000-0x0000000000402200-memory.dmp

Filesize
8KB

Download
memory/3036-0-0x000007FEF5B90000-0x000007FEF652D000-memory.dmp

Filesize
9.6MB

Download
memory/3036-1-0x0000000000A00000-0x0000000000A80000-memory.dmp

Filesize
512KB

Download
memory/3036-2-0x000007FEF5B90000-0x000007FEF652D000-memory.dmp

Filesize
9.6MB

Download
memory/3036-8-0x0000000000A00000-0x0000000000A80000-memory.dmp

Filesize
512KB

Download
memory/3036-21-0x0000000000A00000-0x0000000000A80000-memory.dmp

Filesize
512KB

Download
memory/3036-20-0x000007FEF5B90000-0x000007FEF652D000-memory.dmp

Filesize
9.6MB

Download