f5f14b9073f86da926a8ed319b3289b893442414d1511e45177f6915fb4e5478

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 17:24

Target
Loader.exe
Size 490KB
Sample240613-vyp1vsxcnd
SHA256 f5f14b9073f86da926a8ed319b3289b893442414d1511e45177f6915fb4e5478
MD5 9c9245810bad661af3d6efec543d34fd
SHA1 93e4f301156d120a87fe2c4be3aaa28b9dfd1a8d
SHA512 90d9593595511e722b733a13c53d2e69a1adc9c79b3349350deead2c1cdfed615921fb503597950070e9055f6df74bb64ccd94a60d7716822aa632699c70b767
SSDEEP 6144:3PkcFUUUQHs5TlOhDuy4VjmSO6/tU4j06xeJyCjvhsXZ4m05d0qCsfBLuWWCV/rr:3McWUUysz/NhKjJPhM4/5bV/rvgE3
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2428	2440	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2428	2440	Loader.exe	29
PID 2440 wrote to memory of 2428	2440	Loader.exe	29
PID 2440 wrote to memory of 2428	2440	Loader.exe	29
PID 2440 wrote to memory of 2428	2440	Loader.exe	29

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 128
  2⤵
  - Program crash
  PID:2428

memory/2440-0-0x00000000001E0000-0x000000000022B000-memory.dmp

Download

memory/2440-5-0x00000000000F0000-0x00000000000F1000-memory.dmp

Download

memory/2440-6-0x00000000001E0000-0x000000000022B000-memory.dmp

Download