63ce1d90d0fc261f2b5daa7d7c96c265c4a758e0e1ea4e7a915f9e0d92c332a5

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-01-2025 15:51

Target

Stub/Criptor.exe
Size

26KB
MD5

55304fba6f0df55a53ffa3ade5e28400
SHA1

57ded2c61a129ece115f24bb81eaea2b6919a292
SHA256

bb0d209d5f80f7a98d13105082c66de729a45ac3edcedcd5d461247d770c1f0e
SHA512

606da5e1caf71d643ca0806a997193d5cdeafcc9d2e5bce3886cbfdcefb6a84c83c534042d62a0274ef17a775e87958ad9e616abab75a91911cf14872fa64d95
SSDEEP

384:6JSAghLajiI72q9ycnlNHHVHm2U8jNSwZygidcJi5UjW79XkjOrpLoBGxCt:6uaeUF9ycl5VH2Avhusi5UjWJDq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 656	1292	Criptor.exe	30
PID 1292 wrote to memory of 656	1292	Criptor.exe	30
PID 1292 wrote to memory of 656	1292	Criptor.exe	30

C:\Users\Admin\AppData\Local\Temp\Stub\Criptor.exe
"C:\Users\Admin\AppData\Local\Temp\Stub\Criptor.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1292 -s 516
  2⤵
  PID:656

memory/1292-0-0x000007FEF5DE3000-0x000007FEF5DE4000-memory.dmp

Filesize
4KB

Download
memory/1292-1-0x0000000001390000-0x000000000139C000-memory.dmp

Filesize
48KB

Download