78fc041bb6cd457c95ea9c48d4c0f8cfff3fc1e536b2a4b95f8c0a831306d7a3

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 10:46

Target
DREAM ADVENCED v1.0 LOADER.exe
Size 50KB
Sample240620-mtzeqstaph
SHA256 78fc041bb6cd457c95ea9c48d4c0f8cfff3fc1e536b2a4b95f8c0a831306d7a3
MD5 16a32a68141aae7a17974232dc582c27
SHA1 b988401d759ad189e1b513060957844696c84b10
SHA512 1750456f93518e2ae8c5402d85f27a89278be321e5ecfcd55815692a9c20a1fcfd136f558e6a96fd2489ad1b715bfd87b08b22116782143d95e73c2503c7ff45
SSDEEP 768:aCIFqb4fKE8SrLjMITOfjyfl4UqWYoOgJT9XbOfq1akEDwr:aC4qb4fKE63fWfl4yNbOoEDwr
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2304	2444	DREAM ADVENCED v1.0 LOADER.exe	28
PID 2444 wrote to memory of 2304	2444	DREAM ADVENCED v1.0 LOADER.exe	28
PID 2444 wrote to memory of 2304	2444	DREAM ADVENCED v1.0 LOADER.exe	28

C:\Users\Admin\AppData\Local\Temp\DREAM ADVENCED v1.0 LOADER.exe
"C:\Users\Admin\AppData\Local\Temp\DREAM ADVENCED v1.0 LOADER.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2444 -s 528
  2⤵
  PID:2304

memory/2444-0-0x000007FEF6283000-0x000007FEF6284000-memory.dmp

Download

memory/2444-1-0x0000000000F10000-0x0000000000F22000-memory.dmp

Download

memory/2444-2-0x000007FEF6283000-0x000007FEF6284000-memory.dmp

Download