93e5e7f018053c445c521b010caff89e61f61743635db3500aad32d6e495abb2

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 05:02

Target

Xworm V5.6.exe
Size

14.9MB
MD5

db51a102eab752762748a2dec8f7f67a
SHA1

194688ec1511b83063f7b0167ae250764b7591d1
SHA256

93e5e7f018053c445c521b010caff89e61f61743635db3500aad32d6e495abb2
SHA512

fb2fb6605a17fedb65e636cf3716568e85b8ea423c23e0513eb87f3a3441e2cabc4c3e6346225a9bf7b81e97470f3ab516feea649a7afb5cdf02faff8d7f09a5
SSDEEP

196608:k4/BAe1d4ihvy85JhhYc3BSL1kehn4inje:kuyIhhkRka4i

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1912	1628	Xworm V5.6.exe	30
PID 1628 wrote to memory of 1912	1628	Xworm V5.6.exe	30
PID 1628 wrote to memory of 1912	1628	Xworm V5.6.exe	30

C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
"C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1628 -s 740
  2⤵
  PID:1912

memory/1628-0-0x000007FEF6323000-0x000007FEF6324000-memory.dmp

Filesize
4KB

Download
memory/1628-1-0x0000000000A00000-0x00000000018E8000-memory.dmp

Filesize
14.9MB

Download
memory/1628-2-0x000007FEF6320000-0x000007FEF6D0C000-memory.dmp

Filesize
9.9MB

Download
memory/1628-3-0x000007FEF6320000-0x000007FEF6D0C000-memory.dmp

Filesize
9.9MB

Download
memory/1628-4-0x000007FEF6323000-0x000007FEF6324000-memory.dmp

Filesize
4KB

Download
memory/1628-5-0x000007FEF6320000-0x000007FEF6D0C000-memory.dmp

Filesize
9.9MB

Download