ed19d7f0451d38e5aaeb65bf02d81d278f6f2b575b7876581ea26c97db3672fe

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 12:45

Target

Lskj.PubPrint.exe
Size

164KB
MD5

e8f117c6823f9efeab1c4ffb88e14f0a
SHA1

05688289bc1dd59bd818af3665e46199964f9d80
SHA256

ed19d7f0451d38e5aaeb65bf02d81d278f6f2b575b7876581ea26c97db3672fe
SHA512

10fd507bd7825bd30eb68cb41b8247795b97c43edcbb855a8096aebac836570cbc7a10ffd270931a828306d4092c11a783fd3b4e8fe98d3d89fbf176d166fd21
SSDEEP

768:g6Qg8G5RyqQMLZVt5EQCLj0oaAlnTWhtVps1ROZRt96a226voeF750fATXpOZRt0:oqr3z6a2xvoelTLk3z6a2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1184	2352	WerFault.exe	10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 1184	2352	Lskj.PubPrint.exe	28
PID 2352 wrote to memory of 1184	2352	Lskj.PubPrint.exe	28
PID 2352 wrote to memory of 1184	2352	Lskj.PubPrint.exe	28
PID 2352 wrote to memory of 1184	2352	Lskj.PubPrint.exe	28

C:\Users\Admin\AppData\Local\Temp\Lskj.PubPrint.exe
"C:\Users\Admin\AppData\Local\Temp\Lskj.PubPrint.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 552
  2⤵
  - Program crash
  PID:1184

memory/2352-1-0x0000000074C20000-0x000000007530E000-memory.dmp

Filesize
6.9MB

Download
memory/2352-0-0x0000000000C30000-0x0000000000C5E000-memory.dmp

Filesize
184KB

Download
memory/2352-2-0x0000000074C20000-0x000000007530E000-memory.dmp

Filesize
6.9MB

Download