c70b08c3fd98f1ce7f7c09f50675d32b541c426ba910ef60910e1ef311a77c18

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 15:03

Target

P.O.exe
Size

992KB
MD5

40cdcf82597a3b671864a6a3bbacfcfb
SHA1

e7e08b0740ca0e4b7e380259fbeeed46fc515ec5
SHA256

f8263608067d7587f30cf0f846b3abde252544a55c0ac9f9f6aca7aee08ce46d
SHA512

9b860dd3f53ce78b44df57ee601bbde975cd34c7e761eb1075f196d2210f0cbe189ddf4c6755deffc353d5ee3fd9c9ef538f639fadc41d9726227ee327aa251f
SSDEEP

24576:kh30afvzgozWz40XabU7s1QbrdECXFc5LYW2t8LT2Ug/:kh30afbgrzvXabisab7+tYW2tITVK

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1916	P.O.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2332	1916	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2332	1916	P.O.exe	28
PID 1916 wrote to memory of 2332	1916	P.O.exe	28
PID 1916 wrote to memory of 2332	1916	P.O.exe	28
PID 1916 wrote to memory of 2332	1916	P.O.exe	28

C:\Users\Admin\AppData\Local\Temp\P.O.exe
"C:\Users\Admin\AppData\Local\Temp\P.O.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 596
  2⤵
  - Program crash
  PID:2332

\Users\Admin\AppData\Local\Temp\native.dll

Filesize
427KB

MD5
2404641587cbbe35483b92fd7ef5cf52

SHA1
e55ade94bbe33cd118e308fd6faf7c639eff6190

SHA256
93d4970c562856df783e08b36ccedf6b888c2fe3b3af84952103095bf1af45c3

SHA512
09c05ce0c37c542771369368d31d758a2486bf13bb5ecdf2a7f3ac176ddaae4c1333fd2b8417d7dc98b30a9c713dac60a38440bc1540adfcbf3f2fe77966361c

Download Submit
memory/1916-0-0x00000000000D0000-0x00000000001CE000-memory.dmp

Filesize
1016KB

Download
memory/1916-1-0x0000000074240000-0x000000007492E000-memory.dmp

Filesize
6.9MB

Download
memory/1916-2-0x00000000044C0000-0x0000000004500000-memory.dmp

Filesize
256KB

Download
memory/1916-4-0x00000000002F0000-0x000000000030A000-memory.dmp

Filesize
104KB

Download
memory/1916-3-0x0000000004E30000-0x0000000004F4E000-memory.dmp

Filesize
1.1MB

Download
memory/1916-10-0x0000000073E00000-0x0000000073E99000-memory.dmp

Filesize
612KB

Download
memory/1916-11-0x00000000005C0000-0x00000000005C8000-memory.dmp

Filesize
32KB

Download
memory/1916-12-0x0000000074240000-0x000000007492E000-memory.dmp

Filesize
6.9MB

Download
memory/1916-13-0x00000000044C0000-0x0000000004500000-memory.dmp

Filesize
256KB

Download
memory/1916-14-0x0000000073E00000-0x0000000073E99000-memory.dmp

Filesize
612KB

Download