22e8296dcc096f37d2de3d53f2e4c291bcc1ecff63eaab74676a531343225074

Analysis

max time kernel
27s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 19:08

Target

6vCuCcOa0q4Qfuu.exe
Size

8.8MB
MD5

a8ef06b1272a44e36d271e7764ecea59
SHA1

62126ef7097f68eddfe0620143b13682481913b6
SHA256

22e8296dcc096f37d2de3d53f2e4c291bcc1ecff63eaab74676a531343225074
SHA512

237615240b64b1d716287279ae20d5e62861624c73f353585fcd5c77a9994bbb5cb5f980befd8eec06d3ed7859b6fdb7a807aaf9fb5d1989bb939d33bb056dec
SSDEEP

196608:RPRKC5SM3Gxg6M1NzReRjqZ0i5rG/6BolhEAb79w+2hMMgEtKW3jF:3KjMsgLjMRQ1DaPZ7D2mJEtNF

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2152	6vCuCcOa0q4Qfuu.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 848	2152	6vCuCcOa0q4Qfuu.exe	30
PID 2152 wrote to memory of 848	2152	6vCuCcOa0q4Qfuu.exe	30
PID 2152 wrote to memory of 848	2152	6vCuCcOa0q4Qfuu.exe	30

C:\Users\Admin\AppData\Local\Temp\6vCuCcOa0q4Qfuu.exe
"C:\Users\Admin\AppData\Local\Temp\6vCuCcOa0q4Qfuu.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2152 -s 156
  2⤵
  PID:848

memory/2152-0-0x000000013F990000-0x000000013FD28000-memory.dmp

Filesize
3.6MB

Download
memory/2152-3-0x0000000077890000-0x0000000077892000-memory.dmp

Filesize
8KB

Download
memory/2152-1-0x0000000077890000-0x0000000077892000-memory.dmp

Filesize
8KB

Download
memory/2152-5-0x0000000077890000-0x0000000077892000-memory.dmp

Filesize
8KB

Download
memory/2152-10-0x000000013F050000-0x0000000140640000-memory.dmp

Filesize
21.9MB

Download
memory/2152-11-0x000000013F050000-0x0000000140640000-memory.dmp

Filesize
21.9MB

Download
memory/2152-12-0x000000013F990000-0x000000013FD28000-memory.dmp

Filesize
3.6MB

Download
memory/2152-13-0x000000013F050000-0x0000000140640000-memory.dmp

Filesize
21.9MB

Download
memory/2152-14-0x000000013F050000-0x0000000140640000-memory.dmp

Filesize
21.9MB

Download