62c8b0b02dcd3e8159e6b22a95de398a9cb59d7bd1249152498b291bbaee732b

Resubmissions

21-05-2024 15:12

21-05-2024 15:11

max time kernel
590s
max time network
364s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 15:11

Target

S2 XP/RSDKv4.exe
Size

1.5MB
MD5

92b0481f49853b65c26ac25b21f8ac3f
SHA1

81f428304b938421cef1f19e6911defec3fd1b1f
SHA256

611a08478b2d5dfa6e8562eab04020c3017cd9593ba2dcc2e728342db38aec5e
SHA512

ce6c83878419d48b7e795d72016320938eeede4e2888419c9d345da5beee8a6ec8e6686e6bdf0e87a212ddb9a8cd083c715be6d69b39a328ba2b6958efb2b7f0
SSDEEP

12288:jxn4hyvlfmiUwZgsnT6lFzJFsPcXJgizeStqV26eF4tN6sZitd1BQvM:FrNeHz3LJgqpC26eF8VZitd1BQ0

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2812 2928 WerFault.exe RSDKv4.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RSDKv4.exe

pid process

2928 RSDKv4.exe

pid	pid_target	process	target process
2812	2928	WerFault.exe	RSDKv4.exe

pid	process
2928	RSDKv4.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

RSDKv4.exe

description	pid	process	target process
PID 2928 wrote to memory of 2812	2928	RSDKv4.exe	WerFault.exe
PID 2928 wrote to memory of 2812	2928	RSDKv4.exe	WerFault.exe
PID 2928 wrote to memory of 2812	2928	RSDKv4.exe	WerFault.exe
PID 2928 wrote to memory of 2812	2928	RSDKv4.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\S2 XP\RSDKv4.exe
"C:\Users\Admin\AppData\Local\Temp\S2 XP\RSDKv4.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 736
  2⤵
  - Program crash
  PID:2812

memory/2928-2-0x0000000074750000-0x000000007494B000-memory.dmp

Filesize
2.0MB

Download