12d8dedb484994e507b60fdbf55382c79e70ddb22e5893314a59430322065fc4

Analysis

max time kernel
141s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 15:59

Target

Mythic_Marbles_CH.exe
Size

5.5MB
MD5

9dfb3dbd207f1ed6c769b072987eb994
SHA1

14bb24a7ab9d7c040f3fce88d31b9263cbeae8c2
SHA256

ba48b005cc9b65d71d78cad6ad797c6dc0a8a37639c2ac778e515024965c9a70
SHA512

6973cad973f17e84f970b020bbb7c8dbcc9fe0a8fb7a8ae214389c32b94eed7fc554bced88ab3fd18f7576e87d9566dd8fe9c943abf3e07c91eb67e8605d2aa7
SSDEEP

98304:pxhMfR6t3en0VgoflW1/iWTi1aJD5Sc+WwSCifbcr4bdWrFWUxP3CcXMk4LqbKRP:SfA3BVdk/vrScJDVfbMydkFnpa+bxDyJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2244	2488	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2244	2488	Mythic_Marbles_CH.exe	29
PID 2488 wrote to memory of 2244	2488	Mythic_Marbles_CH.exe	29
PID 2488 wrote to memory of 2244	2488	Mythic_Marbles_CH.exe	29
PID 2488 wrote to memory of 2244	2488	Mythic_Marbles_CH.exe	29

C:\Users\Admin\AppData\Local\Temp\Mythic_Marbles_CH.exe
"C:\Users\Admin\AppData\Local\Temp\Mythic_Marbles_CH.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 676
  2⤵
  - Program crash
  PID:2244

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x5dc
1⤵
PID:2168

memory/2488-0-0x0000000000400000-0x0000000000570000-memory.dmp

Filesize
1.4MB

Download
memory/2488-1-0x0000000000401000-0x00000000004FD000-memory.dmp

Filesize
1008KB

Download
memory/2488-8-0x0000000000400000-0x0000000000570000-memory.dmp

Filesize
1.4MB

Download