0e50b3386e98d5050f3ba9c733c21b197e567d2db6298e7bd28bc7a96c0d7b1b

Analysis

max time kernel
122s
max time network
142s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08/10/2023, 01:18

Target

0e50b3386e98d5050f3ba9c733c21b197e567d2db6298e7bd28bc7a96c0d7b1b.exe
Size

6KB
MD5

ccfc7a8fd6ba2ca54788f901ade718ea
SHA1

68e06cbfe63137b375c46fdc81094ef599294090
SHA256

0e50b3386e98d5050f3ba9c733c21b197e567d2db6298e7bd28bc7a96c0d7b1b
SHA512

b3571f12bd436cbbdb010d1bca078286cba7e2d95e2c445c81a62ebaeef2e63ed1b926ddf1649b15fcd5916ecf9eac27a9aa460b2c543b4c18eddd297af002bf
SSDEEP

48:SFbt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9u5O:A0mIGnFc/38+N4ZHJWSY9FI5Wq6x

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2776	2764	0e50b3386e98d5050f3ba9c733c21b197e567d2db6298e7bd28bc7a96c0d7b1b.exe	29
PID 2764 wrote to memory of 2776	2764	0e50b3386e98d5050f3ba9c733c21b197e567d2db6298e7bd28bc7a96c0d7b1b.exe	29
PID 2764 wrote to memory of 2776	2764	0e50b3386e98d5050f3ba9c733c21b197e567d2db6298e7bd28bc7a96c0d7b1b.exe	29

C:\Users\Admin\AppData\Local\Temp\0e50b3386e98d5050f3ba9c733c21b197e567d2db6298e7bd28bc7a96c0d7b1b.exe
"C:\Users\Admin\AppData\Local\Temp\0e50b3386e98d5050f3ba9c733c21b197e567d2db6298e7bd28bc7a96c0d7b1b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2764 -s 32
  2⤵
  PID:2776