fdb6dcbb4c2aaff36aefd82c21ae21651d90d5d68fff5ae28bb7e76b1310d99a

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08-01-2024 10:48

Target

4b3af6072e6290fbd5b0b18d8a13a9db.exe
Size

1KB
MD5

4b3af6072e6290fbd5b0b18d8a13a9db
SHA1

542aeffcccf643d52821b06e0d432bec4accc87c
SHA256

fdb6dcbb4c2aaff36aefd82c21ae21651d90d5d68fff5ae28bb7e76b1310d99a
SHA512

c20ecc748da6f951016b5174b53ae7e4142018add9f71cbae29ba174a9b5d6ca71229544e62d8c0fccf86520cbb823a553583500bcf3bd9da2c5ab3cde85d3a2

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2784	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2744	2012	WerFault.exe	29

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 2784	1320	4b3af6072e6290fbd5b0b18d8a13a9db.exe	28
PID 1320 wrote to memory of 2784	1320	4b3af6072e6290fbd5b0b18d8a13a9db.exe	28
PID 1320 wrote to memory of 2784	1320	4b3af6072e6290fbd5b0b18d8a13a9db.exe	28
PID 1320 wrote to memory of 2784	1320	4b3af6072e6290fbd5b0b18d8a13a9db.exe	28
PID 1320 wrote to memory of 2012	1320	4b3af6072e6290fbd5b0b18d8a13a9db.exe	29
PID 1320 wrote to memory of 2012	1320	4b3af6072e6290fbd5b0b18d8a13a9db.exe	29
PID 1320 wrote to memory of 2012	1320	4b3af6072e6290fbd5b0b18d8a13a9db.exe	29
PID 1320 wrote to memory of 2012	1320	4b3af6072e6290fbd5b0b18d8a13a9db.exe	29
PID 1320 wrote to memory of 2012	1320	4b3af6072e6290fbd5b0b18d8a13a9db.exe	29
PID 2012 wrote to memory of 2744	2012	svchost.exe	31
PID 2012 wrote to memory of 2744	2012	svchost.exe	31
PID 2012 wrote to memory of 2744	2012	svchost.exe	31
PID 2012 wrote to memory of 2744	2012	svchost.exe	31

C:\Users\Admin\AppData\Local\Temp\4b3af6072e6290fbd5b0b18d8a13a9db.exe
"C:\Users\Admin\AppData\Local\Temp\4b3af6072e6290fbd5b0b18d8a13a9db.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c.bat C:\Users\Admin\AppData\Local\Temp\4b3af6072e6290fbd5b0b18d8a13a9db.exe
  2⤵
  - Deletes itself
  PID:2784
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 52
    3⤵
    - Program crash
    PID:2744

C:\Users\Admin\AppData\Local\Temp\c.bat

Filesize
404B

MD5
6c2f63698a08b310db71328b270a24f7

SHA1
dbfc63343722e2b7860b58d64cc89081207ed6d2

SHA256
38f8f02665b6dc6653faf8d93bcd98b61af2d8d080f8eb37d14938838b0c220e

SHA512
218708d4251186eca1b53d62067d6d2bea2c3dbfc937984cd26172d99f3f6f38a81a7fbc470da2d9df8d1185bc69468a2fcfc7de7cfa6291fa913fb71c2c5e8d

Download Submit
memory/1320-7-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2012-8-0x0000000000620000-0x0000000000628000-memory.dmp

Filesize
32KB

Download