2e6314a6721ade872f5d20bb2e5bcb6f98eb16add5db89d421457830c01b7fdc

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:10

Target

2e6314a6721ade872f5d20bb2e5bcb6f98eb16add5db89d421457830c01b7fdc.exe
Size

2.8MB
MD5

ad09def71b89513a4a407fd37b54d84e
SHA1

4d84f85c0bac0ec94930c1854feac5f7dbe47b25
SHA256

2e6314a6721ade872f5d20bb2e5bcb6f98eb16add5db89d421457830c01b7fdc
SHA512

6f8a2fe0fc8e4557ed4e7dc00847016396d2aceb90c48498efc5286d6c806638aa67ee8deaa8a9ecfd665454301a84eed93f97b515d6367bcc8e88515e5ddcb6
SSDEEP

24576:s9JA0n2Sra1lFEcCTJnmFWK8E8K5V24j5ZG6Kv:s9JzruUT5UG6Kv

Score

9^/10

Detects executables packed with Dotfuscator 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2896-1-0x000000003F620000-0x000000003F8EC000-memory.dmp	INDICATOR_EXE_Packed_Dotfuscator

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2e6314a6721ade872f5d20bb2e5bcb6f98eb16add5db89d421457830c01b7fdc.exe

description	pid	process	target process
PID 2896 wrote to memory of 2256	2896	2e6314a6721ade872f5d20bb2e5bcb6f98eb16add5db89d421457830c01b7fdc.exe	WerFault.exe
PID 2896 wrote to memory of 2256	2896	2e6314a6721ade872f5d20bb2e5bcb6f98eb16add5db89d421457830c01b7fdc.exe	WerFault.exe
PID 2896 wrote to memory of 2256	2896	2e6314a6721ade872f5d20bb2e5bcb6f98eb16add5db89d421457830c01b7fdc.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2e6314a6721ade872f5d20bb2e5bcb6f98eb16add5db89d421457830c01b7fdc.exe
"C:\Users\Admin\AppData\Local\Temp\2e6314a6721ade872f5d20bb2e5bcb6f98eb16add5db89d421457830c01b7fdc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2896 -s 528
  2⤵
  PID:2256

memory/2896-0-0x000007FEF5743000-0x000007FEF5744000-memory.dmp

Filesize
4KB

Download
memory/2896-1-0x000000003F620000-0x000000003F8EC000-memory.dmp

Filesize
2.8MB

Download
memory/2896-2-0x000007FEF5743000-0x000007FEF5744000-memory.dmp

Filesize
4KB

Download