b878bfc5791ec1039c16b2e81e465fe511e04619f1952f1b34c4d5a28d3eb60d

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25-01-2025 18:58

Target

Source Leak/Release/Source.exe
Size

1.2MB
MD5

6179f45e49ae7257c1fb5859dc119f73
SHA1

14b8a63e92e4d9254a3949f841631b96f5eaa590
SHA256

7dc826deb7225c544091b7a33f6e9093617941d90fba7c5b5057ff97e231270f
SHA512

6f492fa5a1c7ba28c269355f80e316db05186ffd9ed28c72b1ce911cb8f46a10049fcfd09008ee99996194f4d154eb46e8b7af98c31db98a4a3690397a46b519
SSDEEP

24576:CoJOLUTJcMfM2kO9shrYgTnwxznA1sUo1sUa2hZU6EmC3Fp39zZF35:7BnLUDUZi6EZFbVb

Score

1^/10

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2192	2432	Source.exe	31
PID 2432 wrote to memory of 2192	2432	Source.exe	31
PID 2432 wrote to memory of 2192	2432	Source.exe	31
PID 2432 wrote to memory of 2024	2432	Source.exe	32
PID 2432 wrote to memory of 2024	2432	Source.exe	32
PID 2432 wrote to memory of 2024	2432	Source.exe	32
PID 2432 wrote to memory of 1156	2432	Source.exe	33
PID 2432 wrote to memory of 1156	2432	Source.exe	33
PID 2432 wrote to memory of 1156	2432	Source.exe	33

C:\Users\Admin\AppData\Local\Temp\Source Leak\Release\Source.exe
"C:\Users\Admin\AppData\Local\Temp\Source Leak\Release\Source.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2024
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2432 -s 132
  2⤵
  PID:1156