32d34db27a035d122a2709006b329ddede4eda26e379986d2927fde5e87a722e

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 23:02

Target

9a254a47f23b77c47d4ebe5a6e20102d.exe
Size

212KB
MD5

9a254a47f23b77c47d4ebe5a6e20102d
SHA1

0506b94bca456e2b011125c88d1cbf530ba64050
SHA256

32d34db27a035d122a2709006b329ddede4eda26e379986d2927fde5e87a722e
SHA512

093b145c6c433bd09fc492932b4c4eec7d5b1b755a094490d26f1185ade5831faf82c3fddc5e1ae2e29558ed8172962275ae41e43a1a2671a94c8fa5ac09e057
SSDEEP

3072:ESnHlkwIaGTDgAswspYHNPBjdR++HKqGWby:9nIawhswsat9dR+NW

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\spool\PRTPROCS\x64\2593D7D.tmp	9a254a47f23b77c47d4ebe5a6e20102d.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2420	3056	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2420	3056	9a254a47f23b77c47d4ebe5a6e20102d.exe	28
PID 3056 wrote to memory of 2420	3056	9a254a47f23b77c47d4ebe5a6e20102d.exe	28
PID 3056 wrote to memory of 2420	3056	9a254a47f23b77c47d4ebe5a6e20102d.exe	28
PID 3056 wrote to memory of 2420	3056	9a254a47f23b77c47d4ebe5a6e20102d.exe	28

C:\Users\Admin\AppData\Local\Temp\9a254a47f23b77c47d4ebe5a6e20102d.exe
"C:\Users\Admin\AppData\Local\Temp\9a254a47f23b77c47d4ebe5a6e20102d.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 248
  2⤵
  - Program crash
  PID:2420

memory/3056-0-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/3056-1-0x00000000001C0000-0x00000000001DB000-memory.dmp

Filesize
108KB

Download
memory/3056-2-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/3056-4-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/3056-10-0x00000000001C0000-0x00000000001DB000-memory.dmp

Filesize
108KB

Download
memory/3056-11-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download