3f1c0691007fcc536c2dcc46fb32cd3c026642a3c4b84eb13b7f9bd5bf9eade4

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07-10-2023 08:29

Target

3f1c0691007fcc536c2dcc46fb32cd3c026642a3c4b84eb13b7f9bd5bf9eade4.exe
Size

917KB
MD5

dad9af89cd2bbd60d76afa38e62b1a46
SHA1

a1772318a687f92b62629414ab6ba79c58879222
SHA256

3f1c0691007fcc536c2dcc46fb32cd3c026642a3c4b84eb13b7f9bd5bf9eade4
SHA512

9a2d151fd07e45c75b16746b124043e8b1358ea563d54fdf4fe503d7e10b4184747f91f758307cfb778670de674f76d647a3a6c89930b747703ec30a06f80b0d
SSDEEP

24576:uj4hf/jo4LG28maNTDnEwCLi0lUztwJRD:uj4hf/jo4C23aBDnEwCLi0lUUD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 3004	2224	3f1c0691007fcc536c2dcc46fb32cd3c026642a3c4b84eb13b7f9bd5bf9eade4.exe	28
PID 2224 wrote to memory of 3004	2224	3f1c0691007fcc536c2dcc46fb32cd3c026642a3c4b84eb13b7f9bd5bf9eade4.exe	28
PID 2224 wrote to memory of 3004	2224	3f1c0691007fcc536c2dcc46fb32cd3c026642a3c4b84eb13b7f9bd5bf9eade4.exe	28

C:\Users\Admin\AppData\Local\Temp\3f1c0691007fcc536c2dcc46fb32cd3c026642a3c4b84eb13b7f9bd5bf9eade4.exe
"C:\Users\Admin\AppData\Local\Temp\3f1c0691007fcc536c2dcc46fb32cd3c026642a3c4b84eb13b7f9bd5bf9eade4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2224 -s 40
  2⤵
  PID:3004

memory/2224-0-0x000000013F790000-0x000000013F87C000-memory.dmp

Filesize
944KB

Download