f42d4117f7266093df5de5b87d5e31c80fed30703422424d1ef07e826381ce3e

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 13:31

Target
2/cloudmusic.exe
Size 171KB
Sample240119-qsnhmafee4
SHA256 d6b5e2a415feaa2f658e69fc29f6c2d529698db293ad4a785d7822efed9fcd0e
MD5 a80f1cb0a69392a9e2a59137ea335b26
SHA1 b7ef0be775e5d84c83faf334e267a206f231ea44
SHA512 bae411332a0cdcdb463ac438441dffa28f3c8aa54560f084bda8f3c82125b07df5e3d0defeb63a427c2ae6a39e4518287095113570367a4d1003baa90285f5ec
SSDEEP 3072:msX/ZD7xGjfzm+yPgeA2l4PVP8ermGQNB1LSwx3EF:X/TGe+S0iH+wx3+
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1984	1152	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 1984	1152	cloudmusic.exe	28
PID 1152 wrote to memory of 1984	1152	cloudmusic.exe	28
PID 1152 wrote to memory of 1984	1152	cloudmusic.exe	28
PID 1152 wrote to memory of 1984	1152	cloudmusic.exe	28

C:\Users\Admin\AppData\Local\Temp\2\cloudmusic.exe
"C:\Users\Admin\AppData\Local\Temp\2\cloudmusic.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 44
  2⤵
  - Program crash
  PID:1984