4f73f9d7f18278838f5528c140adb6052cc333c3fc9adc46bcf938d450747ceb

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
04/10/2023, 11:45

Target

PsBypassCLM.exe
Size

34KB
MD5

8fa6eb3efef8871ff808f0306b3e97a9
SHA1

f1f547778e33334dd9d11c18002276370f6c19c1
SHA256

4f73f9d7f18278838f5528c140adb6052cc333c3fc9adc46bcf938d450747ceb
SHA512

b3de1bb79e22c94ca020fabdb2099b49d7bc89e19bc276ad3d18c35ec3110bc8117d7b80c2244b19acb7d4efe94a0a788e29095a9237993559a0b0b6e6d7bad7
SSDEEP

768:g7If4JOao5hoBeT94bdAVGDLCHgqG/goyDm24/:gcVfoBeTSemLCjGIox/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2676	2420	PsBypassCLM.exe	29
PID 2420 wrote to memory of 2676	2420	PsBypassCLM.exe	29
PID 2420 wrote to memory of 2676	2420	PsBypassCLM.exe	29

C:\Users\Admin\AppData\Local\Temp\PsBypassCLM.exe
"C:\Users\Admin\AppData\Local\Temp\PsBypassCLM.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2420 -s 696
  2⤵
  PID:2676

memory/2420-0-0x000000013F720000-0x000000013F72E000-memory.dmp

Filesize
56KB

Download
memory/2420-1-0x000000001B7B0000-0x000000001BA92000-memory.dmp

Filesize
2.9MB

Download
memory/2420-2-0x000007FEF58A0000-0x000007FEF628C000-memory.dmp

Filesize
9.9MB

Download
memory/2420-3-0x0000000000760000-0x000000000077C000-memory.dmp

Filesize
112KB

Download
memory/2420-4-0x0000000000950000-0x0000000000998000-memory.dmp

Filesize
288KB

Download
memory/2420-5-0x0000000000780000-0x0000000000788000-memory.dmp

Filesize
32KB

Download
memory/2420-6-0x000000001BD80000-0x000000001BE26000-memory.dmp

Filesize
664KB

Download
memory/2420-7-0x000000001AB80000-0x000000001ABB4000-memory.dmp

Filesize
208KB

Download
memory/2420-8-0x000000001BE30000-0x000000001BE7A000-memory.dmp

Filesize
296KB

Download
memory/2420-9-0x0000000000790000-0x00000000007A6000-memory.dmp

Filesize
88KB

Download
memory/2420-10-0x000000001BF20000-0x000000001BFA0000-memory.dmp

Filesize
512KB

Download
memory/2420-11-0x000007FEF58A0000-0x000007FEF628C000-memory.dmp

Filesize
9.9MB

Download
memory/2420-12-0x000000001BF20000-0x000000001BFA0000-memory.dmp

Filesize
512KB

Download