61f6292c090b98f23f5a1d287e2033d24be834caae0f663234912b0bc4331536

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 11:38

Target

x2wg01JC/Qkt9goL5H.exe
Size

125KB
MD5

1b86e7f23393360f0257228745cd77d2
SHA1

ae28f155181d942ed4fdd6f59d4f452cce940320
SHA256

1ad6c4e0c4959acf66fec67c5c34c6e6bd034661972954f27fd9df8a07539569
SHA512

799209aa6136ec71e42ef937f25d8209b66c955b25ab2031928931f19af823df26b15ed6b6d2ab098d9283e2ed964fe6f6af9e9ea6b08f5831bbab463bf589bf
SSDEEP

3072:yt2IhJW9KaY3gc4AXcItYamdfduUQcJClt83p02K/5ySVF:1IzyKHaAFYtiUQaBw5ygF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1940	3064	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3064	Qkt9goL5H.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 1940	3064	Qkt9goL5H.exe	28
PID 3064 wrote to memory of 1940	3064	Qkt9goL5H.exe	28
PID 3064 wrote to memory of 1940	3064	Qkt9goL5H.exe	28
PID 3064 wrote to memory of 1940	3064	Qkt9goL5H.exe	28

C:\Users\Admin\AppData\Local\Temp\x2wg01JC\Qkt9goL5H.exe
"C:\Users\Admin\AppData\Local\Temp\x2wg01JC\Qkt9goL5H.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 128
  2⤵
  - Program crash
  PID:1940

memory/3064-0-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/3064-2-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/3064-4-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/3064-7-0x000000007469D000-0x000000007491F000-memory.dmp

Filesize
2.5MB

Download
memory/3064-5-0x0000000074680000-0x0000000074DC8000-memory.dmp

Filesize
7.3MB

Download
memory/3064-9-0x0000000074680000-0x0000000074DC8000-memory.dmp

Filesize
7.3MB

Download
memory/3064-10-0x00000000000A0000-0x00000000000A3000-memory.dmp

Filesize
12KB

Download
memory/3064-12-0x0000000074680000-0x0000000074DC8000-memory.dmp

Filesize
7.3MB

Download