83af52150d2c570afc1d3e9db129e2a9d8de70dada92366780e0a52c7fd74b95

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 18:18

Target

RoweHack/Oni.exe
Size

24KB
MD5

191259ec846c4ba7dcfcad581340ec1c
SHA1

bda746ace8db7339f890369fc865421b6a0a15de
SHA256

52eefbbe1af287695f5c0e108cf449bf0e1080f114ef2cbf8162b4d4a5ea2cd1
SHA512

e63e9883a95a6446d645c34e1fb56b51f74f1a053fb1718cc9d2362e623653880e198e6d3f85f067271c0b9a7b979b922aa171e082f9836c4cb97c5b6b4a67e2
SSDEEP

384:DAeIhjdS786ZsCAev8QhSmoEH1zAq9HN5qqdlipYrUKq9n9Nb1EIKdEpbAt:EBJS786Z1SmTAqRNtdllrbAXtpb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Oni.exe

description	pid	process	target process
PID 1968 wrote to memory of 1740	1968	Oni.exe	WerFault.exe
PID 1968 wrote to memory of 1740	1968	Oni.exe	WerFault.exe
PID 1968 wrote to memory of 1740	1968	Oni.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\RoweHack\Oni.exe
"C:\Users\Admin\AppData\Local\Temp\RoweHack\Oni.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1968 -s 500
  2⤵
  PID:1740

memory/1968-0-0x000007FEF5753000-0x000007FEF5754000-memory.dmp

Filesize
4KB

Download
memory/1968-1-0x0000000000940000-0x000000000094C000-memory.dmp

Filesize
48KB

Download
memory/1968-2-0x000007FEF5753000-0x000007FEF5754000-memory.dmp

Filesize
4KB

Download