0a44ab477efd83bc0bce8d3ca083aee70b7d05ab4aafe07e6d7cfb27f8764f9a

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 18:28

Target

Moonbug11/MOONBUG.011/APPENDIX.BIN/GEN.exe
Size

16KB
MD5

2d639eab21bf4730fec4ce4668bfc21d
SHA1

22fbaea3d07bce0ea73bd8c8e7342f91a3eee34e
SHA256

e01c32c6a91031b6549b4cf2c3f212db9836baa5a49b313cda9d57dd7b35d7af
SHA512

9d9f5439a2626c1437a206c35091c0d2d5a1a8fb785d649b29549e4fbffa992b1bf98573ec7ae9c8e35b4b38fbc04489f291e742e62d05feec10bf146ee7b450
SSDEEP

24:OEhu702JODQa5YHyFG0uLfuxwGS5gV19ECgc4TAjT/91yEVu2:OEP2JODQaAyFGDfutqe9EC9Bjrec

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2408	2548	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2408	2548	GEN.exe	31
PID 2548 wrote to memory of 2408	2548	GEN.exe	31
PID 2548 wrote to memory of 2408	2548	GEN.exe	31
PID 2548 wrote to memory of 2408	2548	GEN.exe	31

C:\Users\Admin\AppData\Local\Temp\Moonbug11\MOONBUG.011\APPENDIX.BIN\GEN.exe
"C:\Users\Admin\AppData\Local\Temp\Moonbug11\MOONBUG.011\APPENDIX.BIN\GEN.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 96
  2⤵
  - Program crash
  PID:2408

memory/2548-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2548-1-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download