6f633e00e6b6affa3cf1d143aa1aa03e1b86db749a5bd6a042d124f8e465a307

Resubmissions

27/05/2024, 14:44

27/05/2024, 14:43

max time kernel
48s
max time network
17s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 14:43

Target

hamster bot.exe
Size

457KB
MD5

3fa05fb99022e7cf875593a20023cfd7
SHA1

17df533cdebb840765601a26643a10265a490f3c
SHA256

6f633e00e6b6affa3cf1d143aa1aa03e1b86db749a5bd6a042d124f8e465a307
SHA512

361fdd47ed83d525702140e00b331b5247707fca795f3a83db5af49f9644b6f6ab00c9d6c65b453ff2c5f4421681a37c9dab93accb26e4e6d4738c528ebea3de
SSDEEP

6144:7cF99bx85+q2kN3+9rHYSUPpeZMMBOefBrspnHJyDMsC2xK19s1jX2tV2Fwem:oF99bx2yH2MZROyBwHJyDThxNj+V/e

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2668	2164	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2668	2164	hamster bot.exe	28
PID 2164 wrote to memory of 2668	2164	hamster bot.exe	28
PID 2164 wrote to memory of 2668	2164	hamster bot.exe	28
PID 2164 wrote to memory of 2668	2164	hamster bot.exe	28

C:\Users\Admin\AppData\Local\Temp\hamster bot.exe
"C:\Users\Admin\AppData\Local\Temp\hamster bot.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 48
  2⤵
  - Program crash
  PID:2668

memory/2164-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2164-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download