545ff04089ae7c3afed04ebc6224472f99e8e45c707314a6b779a1cd22dc7f9b

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
28/10/2024, 19:33

Target

IcarusRDP_builder-main/Addon/ptata.exe
Size

752KB
MD5

e82f5b59d76bbebb42bf5f7d756c8c96
SHA1

0dd995acfe788ad9f78de08e6c161c067fa591f7
SHA256

d583a31277fc5eca86e7eb472fd513dae76b68a9858bcd1e1ed96514fda0c54e
SHA512

8e3f3bea19665d2cfc1bc64f4db514371f60e76927cc7beec5da6dfed97f4c9f2f406988d7e1a0ad3d87281a83ee0ab36b15b3d808310dedc7d45062bd159620
SSDEEP

12288:Tfbx+p5bu9TlLfUTdwq1pdVBuzrS+ug4jOh99Gzsss5vvSNR:5+vbuhZUTdJVBeubg4jOh99GzssGvSb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1504	2128	ptata.exe	31
PID 2128 wrote to memory of 1504	2128	ptata.exe	31
PID 2128 wrote to memory of 1504	2128	ptata.exe	31

C:\Users\Admin\AppData\Local\Temp\IcarusRDP_builder-main\Addon\ptata.exe
"C:\Users\Admin\AppData\Local\Temp\IcarusRDP_builder-main\Addon\ptata.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2128 -s 540
  2⤵
  PID:1504

memory/2128-0-0x000007FEF5EB3000-0x000007FEF5EB4000-memory.dmp

Filesize
4KB

Download
memory/2128-1-0x0000000001000000-0x00000000010C2000-memory.dmp

Filesize
776KB

Download