bc418a8ea27e4c19309b032113165f2f7d29b0922e14fba9a4eba689fe32bb24

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 14:28

Target
Setup.exe
Size 457KB
Sample240525-rtccesfg4v
SHA256 bbd4ebadb6cf95a4eca65d3c77a250c88d54c31ce76ae11b7fa3fb13d1c4588a
MD5 ee80b9f0a83d2da66013b0bb69964171
SHA1 047e1549b4e9c8a3de441297bdc2656b1430a64c
SHA512 7eaeb5c1c2efc57f42ef1da91ac836fdf2316cd2cd32626a8b7178b4e1cca81ef6f38e8775260f836f1c06033fbc3b29688886574aa7e9035f96d2bb8e295008
SSDEEP 6144:P0KBmV04bcIGQ43L6kHUuXfwL//Vpbaq5G8QVmtGBdFzOMgdHyCwykoc4oSrSy5B:MKBmV00f7Vf6QM2SCCaomh5QIde
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2432	2860	WerFault.exe	27

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2432	2860	Setup.exe	28
PID 2860 wrote to memory of 2432	2860	Setup.exe	28
PID 2860 wrote to memory of 2432	2860	Setup.exe	28
PID 2860 wrote to memory of 2432	2860	Setup.exe	28
PID 2860 wrote to memory of 2432	2860	Setup.exe	28
PID 2860 wrote to memory of 2432	2860	Setup.exe	28
PID 2860 wrote to memory of 2432	2860	Setup.exe	28

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 256
  2⤵
  - Program crash
  PID:2432

memory/2860-0-0x0000000000150000-0x0000000000151000-memory.dmp

Download