bdc61e24b03db5dbdeaf7979906ea51f0bfe388b41d8e7e80bde6d9acd716bba

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:17

Target

bdc61e24b03db5dbdeaf7979906ea51f0bfe388b41d8e7e80bde6d9acd716bba.exe
Size

4.9MB
MD5

d9a7d15ae1511095bc12d4faa9be6f70
SHA1

b90fbb35eb6dd050e4829ecac702feab90f58859
SHA256

bdc61e24b03db5dbdeaf7979906ea51f0bfe388b41d8e7e80bde6d9acd716bba
SHA512

f913e5bbb998ad8a391ea99c6d045081da5af128b9391c3a0249ec4eeb9a504be796b3315e7c5b4bae825b7629527719a845a974f4eba37bd0233b86e5483e25
SSDEEP

98304:NllmCKfheKnF4Gnuyjscn9GtGOqHLixnkmb0ZKH4lODcxSgo5Gn8WuMRIn+N3gNX:NllmCKfY2uWUMBHLi6mb0ZKH4lODcxSL

Score

9^/10

Detects executables packed with Dotfuscator 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2368-1-0x0000000000D00000-0x00000000011EA000-memory.dmp	INDICATOR_EXE_Packed_Dotfuscator

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2560 2368 WerFault.exe bdc61e24b03db5dbdeaf7979906ea51f0bfe388b41d8e7e80bde6d9acd716bba.exe

pid	pid_target	process	target process
2560	2368	WerFault.exe	bdc61e24b03db5dbdeaf7979906ea51f0bfe388b41d8e7e80bde6d9acd716bba.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bdc61e24b03db5dbdeaf7979906ea51f0bfe388b41d8e7e80bde6d9acd716bba.exe

description	pid	process	target process
PID 2368 wrote to memory of 2560	2368	bdc61e24b03db5dbdeaf7979906ea51f0bfe388b41d8e7e80bde6d9acd716bba.exe	WerFault.exe
PID 2368 wrote to memory of 2560	2368	bdc61e24b03db5dbdeaf7979906ea51f0bfe388b41d8e7e80bde6d9acd716bba.exe	WerFault.exe
PID 2368 wrote to memory of 2560	2368	bdc61e24b03db5dbdeaf7979906ea51f0bfe388b41d8e7e80bde6d9acd716bba.exe	WerFault.exe
PID 2368 wrote to memory of 2560	2368	bdc61e24b03db5dbdeaf7979906ea51f0bfe388b41d8e7e80bde6d9acd716bba.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bdc61e24b03db5dbdeaf7979906ea51f0bfe388b41d8e7e80bde6d9acd716bba.exe
"C:\Users\Admin\AppData\Local\Temp\bdc61e24b03db5dbdeaf7979906ea51f0bfe388b41d8e7e80bde6d9acd716bba.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 548
2⤵
- Program crash
PID:2560

memory/2368-0-0x0000000074A0E000-0x0000000074A0F000-memory.dmp

Filesize
4KB

Download
memory/2368-1-0x0000000000D00000-0x00000000011EA000-memory.dmp

Filesize
4.9MB

Download