6af8efa60cbc9bdad8f27c312265a25c1f22a0b6c6b7244c6a6ce10785de4abb

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
21-09-2023 04:37

Target

6af8efa60cbc9bdad8f27c312265a25c1f22a0b6c6b7244c6a6ce10785de4abb.exe
Size

1.2MB
MD5

b7fa887f7682493aca961cf5570e56c2
SHA1

138b930fc6ac8bf135597a1f32ad209f5c627c71
SHA256

6af8efa60cbc9bdad8f27c312265a25c1f22a0b6c6b7244c6a6ce10785de4abb
SHA512

e5e2071cb2aed1b2577abf1efea42f7aea3a1af1f8dc13cfb99b49a8501662cc79950736809d5b2d8e368f72655ccaf69af4076a6cfab2eb240d79c757e69def
SSDEEP

24576:35xPgnTaMLalsGa4gQFhXE/cKCqCavtuHDSijdds03qbJ7:34aMOlZjZjKCGoj/j6V7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 1244	2076	6af8efa60cbc9bdad8f27c312265a25c1f22a0b6c6b7244c6a6ce10785de4abb.exe	28
PID 2076 wrote to memory of 1244	2076	6af8efa60cbc9bdad8f27c312265a25c1f22a0b6c6b7244c6a6ce10785de4abb.exe	28
PID 2076 wrote to memory of 1244	2076	6af8efa60cbc9bdad8f27c312265a25c1f22a0b6c6b7244c6a6ce10785de4abb.exe	28

C:\Users\Admin\AppData\Local\Temp\6af8efa60cbc9bdad8f27c312265a25c1f22a0b6c6b7244c6a6ce10785de4abb.exe
"C:\Users\Admin\AppData\Local\Temp\6af8efa60cbc9bdad8f27c312265a25c1f22a0b6c6b7244c6a6ce10785de4abb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2076 -s 144
  2⤵
  PID:1244