0ef41cdb74e220a2ba138fe0625c210e0c5283c24625c1a45926a930d66dce45

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 17:37

Target

Assassin X.exe
Size

3.4MB
MD5

3d116978ecbae75701e4b942380c9cc4
SHA1

7a65e948e556dc5d99b9473e139e2f8c60e6f226
SHA256

0ef41cdb74e220a2ba138fe0625c210e0c5283c24625c1a45926a930d66dce45
SHA512

9253593927761298f36e2782b0e1920eaa5d13de34b02f5ad1719b3b0b5a69ac8c6c4e32e5c347a4c49cd3e6def693dddf6c5e74cfc9b97cd08ad2aca22a3602
SSDEEP

24576:SNgyNilNR2zTJF2ZHuduTJTyCA59q0aSeQyW72/JW363Qf0ukHe7cOFxNF:2gizdwlyCA59qRSnh2/0se7cOt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2636	2868	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2636	2868	Assassin X.exe	28
PID 2868 wrote to memory of 2636	2868	Assassin X.exe	28
PID 2868 wrote to memory of 2636	2868	Assassin X.exe	28
PID 2868 wrote to memory of 2636	2868	Assassin X.exe	28

C:\Users\Admin\AppData\Local\Temp\Assassin X.exe
"C:\Users\Admin\AppData\Local\Temp\Assassin X.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 776
  2⤵
  - Program crash
  PID:2636

memory/2868-0-0x0000000000E70000-0x00000000011E8000-memory.dmp

Filesize
3.5MB

Download
memory/2868-1-0x0000000074590000-0x0000000074C7E000-memory.dmp

Filesize
6.9MB

Download
memory/2868-2-0x0000000004FC0000-0x0000000005000000-memory.dmp

Filesize
256KB

Download
memory/2868-4-0x00000000005B0000-0x00000000005BA000-memory.dmp

Filesize
40KB

Download
memory/2868-3-0x00000000005B0000-0x00000000005BA000-memory.dmp

Filesize
40KB

Download
memory/2868-5-0x0000000004FC0000-0x0000000005000000-memory.dmp

Filesize
256KB

Download
memory/2868-6-0x0000000074590000-0x0000000074C7E000-memory.dmp

Filesize
6.9MB

Download
memory/2868-7-0x0000000004FC0000-0x0000000005000000-memory.dmp

Filesize
256KB

Download