70971148ed1fadb17a1de707b03b0b61bcf9d523c540b9bf4e411b5bb0dda5f0

Analysis

max time kernel
1563s
max time network
1569s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 18:35

Target

Cronic.exe
Size

14KB
MD5

726d50c3e3dd789d43664aa5c3c3f9de
SHA1

f69e053040b09e422a712c4bf31ce20875186e31
SHA256

8a865d95f2c90c97fe3d762608ebc8040033cac5882e5534675b6b1f056e9c19
SHA512

872b347a0dd0cdb46959b9b41ad20dfc7dcfaf3cee8a27aa90b33700a44147edf631e03c3bd7ca8867dbcb2b02efc6c05ee0e8dd31062770c39d2ad13a1db56a
SSDEEP

96:UxDJBVLZaxd5wLqLodjPdIGeQTH7EZ1U1B2Rti5KaJR/sjMcl13sPNjevqa7pYkC:UZJYVwm6TAE4ixQMpefpvaE55tfVD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2664	2888	Cronic.exe	28
PID 2888 wrote to memory of 2664	2888	Cronic.exe	28
PID 2888 wrote to memory of 2664	2888	Cronic.exe	28

C:\Users\Admin\AppData\Local\Temp\Cronic.exe
"C:\Users\Admin\AppData\Local\Temp\Cronic.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2888 -s 508
  2⤵
  PID:2664