63ce1d90d0fc261f2b5daa7d7c96c265c4a758e0e1ea4e7a915f9e0d92c332a5

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-01-2025 15:51

Target

Stub/netcoreapp5.0/ref/Obfuscator.exe
Size

14KB
MD5

75563750012105583645516053326467
SHA1

84a635bc884112fb719df2aaf926a4f3984d6b93
SHA256

7c081fdfe5d542888565834b0985deb6eef84f506e415708d7c813bc45f76ef7
SHA512

6a90a226a4b97c98ea7f79d5d6a1a8c1dc24e632e35ffbf07016c6816d3fc7c2f90db5bc61adcff9ea1a0d6004b6a7ea8ae845753a86dd0a394af869f3ff4ac6
SSDEEP

192:UN7eJ/sNDlraKTpNPsz4VQtCozmuK6wcaOyptjkCDrsbxwU9:ZJ/kpWq7Pm4VQt1zmuKtQ0tjkCyyU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2252	2484	Obfuscator.exe	31
PID 2484 wrote to memory of 2252	2484	Obfuscator.exe	31
PID 2484 wrote to memory of 2252	2484	Obfuscator.exe	31

C:\Users\Admin\AppData\Local\Temp\Stub\netcoreapp5.0\ref\Obfuscator.exe
"C:\Users\Admin\AppData\Local\Temp\Stub\netcoreapp5.0\ref\Obfuscator.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2484 -s 488
  2⤵
  PID:2252

memory/2484-0-0x000007FEF5BD3000-0x000007FEF5BD4000-memory.dmp

Filesize
4KB

Download
memory/2484-1-0x0000000000A30000-0x0000000000A3C000-memory.dmp

Filesize
48KB

Download