1d6190c79ee157654adb083298f8596c951e4fe35846fb519dbb6f894b6de318

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:37

Target

2024-05-23_55589e01b5baa4e2a14482c4e466e50d_xiaoba.exe
Size

1.2MB
MD5

55589e01b5baa4e2a14482c4e466e50d
SHA1

2650432d848a16063b6b4066bf8e7714e8db8451
SHA256

1d6190c79ee157654adb083298f8596c951e4fe35846fb519dbb6f894b6de318
SHA512

c1c709484b363b970dfde0946bb8edcfd1f90adeb9b02ce0d9de76313640ee31ce22f2fb1189a64f16a435374baa9582bd85029696d2f6dd888a1358bb5e6062
SSDEEP

24576:BfZanlLXYSKEDRWTg+YeP/YkOqLK5bZ6MGY+f:BPSKRM+Y2ZPLKUX

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1744 1952 WerFault.exe 2024-05-23_55589e01b5baa4e2a14482c4e466e50d_xiaoba.exe

pid	pid_target	process	target process
1744	1952	WerFault.exe	2024-05-23_55589e01b5baa4e2a14482c4e466e50d_xiaoba.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-23_55589e01b5baa4e2a14482c4e466e50d_xiaoba.exe

description	pid	process	target process
PID 1952 wrote to memory of 1744	1952	2024-05-23_55589e01b5baa4e2a14482c4e466e50d_xiaoba.exe	WerFault.exe
PID 1952 wrote to memory of 1744	1952	2024-05-23_55589e01b5baa4e2a14482c4e466e50d_xiaoba.exe	WerFault.exe
PID 1952 wrote to memory of 1744	1952	2024-05-23_55589e01b5baa4e2a14482c4e466e50d_xiaoba.exe	WerFault.exe
PID 1952 wrote to memory of 1744	1952	2024-05-23_55589e01b5baa4e2a14482c4e466e50d_xiaoba.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_55589e01b5baa4e2a14482c4e466e50d_xiaoba.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_55589e01b5baa4e2a14482c4e466e50d_xiaoba.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 36
2⤵
- Program crash
PID:1744