79551a4bc7453a47bf6ecabe218c80f7d8d57bb41a9900541d86d990b5cc8188

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 16:24

Target

$PLUGINSDIR/Loader.exe
Size

140KB
MD5

c2cabe6ebb19d079e4d2690762b2ea31
SHA1

96de41ca6db80932da0d2b3c31f00c0fdaa321e3
SHA256

3822aaddcd240a3e5c7a6b1371ee68e9c020e60f8dc555166cef403402481da5
SHA512

94d972677c128df948f6bcdd6a3f6bbd63fcd63903394dca04fdd6256e598af6d29554c7face0477c357be63208d69ec41b1a1b4228681b9a77f5f19d67546a8
SSDEEP

1536:TpYCQrJE22GyV3DbWGLBakmL3w9/Ni/UMRRUufQDSx6uEc3XsWjcdDIVItx4Z/qi:PGA3pmE5NMTP4DSx6uWDIVCx4Rqfudm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3028	348	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 348 wrote to memory of 3028	348	Loader.exe	28
PID 348 wrote to memory of 3028	348	Loader.exe	28
PID 348 wrote to memory of 3028	348	Loader.exe	28
PID 348 wrote to memory of 3028	348	Loader.exe	28

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 204
  2⤵
  - Program crash
  PID:3028