bc385447b7304dd800a66e007287df6858f45559b5d77481348ea030b4e0c6ae

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:15

Target

bc385447b7304dd800a66e007287df6858f45559b5d77481348ea030b4e0c6ae.exe
Size

1005KB
MD5

29fe05e08c721958a43ee828bbb109e8
SHA1

586cae162e9752ece578b423707d55b4f274af64
SHA256

bc385447b7304dd800a66e007287df6858f45559b5d77481348ea030b4e0c6ae
SHA512

97826e5c50f01299479b6faa708d71f11c5aee1444bf71b7d36f6886027090743773f0fad8a7092ca92412d3f414b355c3b71c78d829aa6e9bfa6e688a3b2884
SSDEEP

24576:QAHnh+eWsN3skA4RV1Hom2KXcmtc/SyhaeuiW9Nf:Hh+ZkldoPKsac/vha3JN

Score

5^/10

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/376-0-0x0000000001270000-0x0000000001371000-memory.dmp	autoit_exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1696 376 WerFault.exe bc385447b7304dd800a66e007287df6858f45559b5d77481348ea030b4e0c6ae.exe

pid	pid_target	process	target process
1696	376	WerFault.exe	bc385447b7304dd800a66e007287df6858f45559b5d77481348ea030b4e0c6ae.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bc385447b7304dd800a66e007287df6858f45559b5d77481348ea030b4e0c6ae.exe

description	pid	process	target process
PID 376 wrote to memory of 1696	376	bc385447b7304dd800a66e007287df6858f45559b5d77481348ea030b4e0c6ae.exe	WerFault.exe
PID 376 wrote to memory of 1696	376	bc385447b7304dd800a66e007287df6858f45559b5d77481348ea030b4e0c6ae.exe	WerFault.exe
PID 376 wrote to memory of 1696	376	bc385447b7304dd800a66e007287df6858f45559b5d77481348ea030b4e0c6ae.exe	WerFault.exe
PID 376 wrote to memory of 1696	376	bc385447b7304dd800a66e007287df6858f45559b5d77481348ea030b4e0c6ae.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bc385447b7304dd800a66e007287df6858f45559b5d77481348ea030b4e0c6ae.exe
"C:\Users\Admin\AppData\Local\Temp\bc385447b7304dd800a66e007287df6858f45559b5d77481348ea030b4e0c6ae.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 236
2⤵
- Program crash
PID:1696

memory/376-0-0x0000000001270000-0x0000000001371000-memory.dmp

Filesize
1.0MB

Download