3682fd7729e2d1c435bf7685b8943cd88894af6dfae6e6993e37347779acfb02

Analysis

max time kernel
25s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 12:40

Target

Loader.exe
Size

9.4MB
MD5

6c4d39daba667c766c3e9c315b624a40
SHA1

5ae17810693dc7633f9fb49030862e8f412fdd70
SHA256

3682fd7729e2d1c435bf7685b8943cd88894af6dfae6e6993e37347779acfb02
SHA512

231cfb927aad30e0b2a6f1d2acee95467ce524cae7eaee747f38acb043c104c2404768216dac3ffde2b5d62804c91c97c87b3d948b5ec3e65bbe5c686538b4c2
SSDEEP

196608:CZNGU1UA1CA1LZIUDuMBYRbOUsWicpgpGIEGd1vuufqzwXusH:MUA4A1ZIUDuyY92Wicq134uPes

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2328	2928	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2328	2928	Loader.exe	29
PID 2928 wrote to memory of 2328	2928	Loader.exe	29
PID 2928 wrote to memory of 2328	2928	Loader.exe	29
PID 2928 wrote to memory of 2328	2928	Loader.exe	29

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 628
  2⤵
  - Program crash
  PID:2328

memory/2928-0-0x0000000073C4E000-0x0000000073C4F000-memory.dmp

Filesize
4KB

Download
memory/2928-1-0x0000000000250000-0x0000000000BB2000-memory.dmp

Filesize
9.4MB

Download
memory/2928-2-0x0000000073C40000-0x000000007432E000-memory.dmp

Filesize
6.9MB

Download
memory/2928-3-0x0000000073C4E000-0x0000000073C4F000-memory.dmp

Filesize
4KB

Download
memory/2928-4-0x0000000073C40000-0x000000007432E000-memory.dmp

Filesize
6.9MB

Download