c9bc1cb7f620dc0ca06cb14ac061ebc3eb9d1d31536abf66fadb5afa277c6c8d

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 21:48

Target

hybreieskm.exe
Size

5KB
MD5

3fe13edd25a0779eb87727b4ce3d7818
SHA1

16527b946c3694d83d3e7d8c452ad681a678208f
SHA256

fce6d2715739d7b855a83771d1c6a3e2822d625ca490b990a2908afba8df1dfe
SHA512

fd2b1a8cbd4bc408d3ca283389ba4a87c8421837f8edfe3b98e1bf9ca3a478369103f8cc57a8f8b3d364e637b30c3eafd423249b5ceb4f2e3cc13ca02db44cf4
SSDEEP

48:vpgnzgb33oMBogjqnWDcsVpXUypXUBq+3nNZ8QN6WNSqG3Y+O1z55quQvnRh:BfjDvbXlXR+3NHoWryY+O1z2uuRh

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2032	2208	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

hybreieskm.exe

description	pid	Process	procid_target
PID 2208 wrote to memory of 2032	2208	hybreieskm.exe	28
PID 2208 wrote to memory of 2032	2208	hybreieskm.exe	28
PID 2208 wrote to memory of 2032	2208	hybreieskm.exe	28
PID 2208 wrote to memory of 2032	2208	hybreieskm.exe	28

C:\Users\Admin\AppData\Local\Temp\hybreieskm.exe
"C:\Users\Admin\AppData\Local\Temp\hybreieskm.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 228
  2⤵
  - Program crash
  PID:2032

memory/2208-0-0x0000000000160000-0x0000000000162000-memory.dmp

Filesize
8KB

Download