b2b1f374822e760b574cff680d989d0f229bdaf9029acacb2449162b92bbc16b

Analysis

max time kernel
119s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09-01-2024 07:05

Target

MORPH_93594C2E8879.exe
Size

185KB
MD5

d0b8d51565528b23a4d3727b395dcc67
SHA1

1ba2426be4351645bee5ea613d23c0cd7adf8bb6
SHA256

f0786dc9282a746b73606774a6a76bb947f29b130e3647b49fedd644c7aeeeef
SHA512

afef7b668a5a84f4a5e8df3e0ba29e649308910a6cbb82fdf6e6d2e46a1df7df81c371db254d22d3e6353944cbb1fa8cfd1a9b8c9e5422084ff8eab429ac8f58
SSDEEP

3072:zPba0Z7gARaH7iLvfwH7t3NpaLzoqVe1Lxp4vrMrXBNFPKJ0FjiI:60NRaGLvfwbPYU92IzBN1oEjf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1300	1720	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1300	1720	MORPH_93594C2E8879.exe	17
PID 1720 wrote to memory of 1300	1720	MORPH_93594C2E8879.exe	17
PID 1720 wrote to memory of 1300	1720	MORPH_93594C2E8879.exe	17
PID 1720 wrote to memory of 1300	1720	MORPH_93594C2E8879.exe	17

C:\Users\Admin\AppData\Local\Temp\MORPH_93594C2E8879.exe
"C:\Users\Admin\AppData\Local\Temp\MORPH_93594C2E8879.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 56
  2⤵
  - Program crash
  PID:1300

memory/1720-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download